On Thu, May 23, 2019 at 10:51:58PM +0300, Amir Goldstein wrote: > On Thu, May 23, 2019 at 12:30 PM <gregkh@xxxxxxxxxxxxxxxxxxx> wrote: > > > > > > This is a note to let you know that I've just added the patch titled > > > > ovl: fix missing upper fs freeze protection on copy up for ioctl > > > > to the 4.19-stable tree which can be found at: > > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary > > > > The filename of the patch is: > > ovl-fix-missing-upper-fs-freeze-protection-on-copy-up-for-ioctl.patch > > and it can be found in the queue-4.19 subdirectory. > > > > If you, or anyone else, feels it should not be added to the stable tree, > > please let <stable@xxxxxxxxxxxxxxx> know about it. > > > > > > From 3428030da004a1128cbdcf93dc03e16f184d845b Mon Sep 17 00:00:00 2001 > > From: Amir Goldstein <amir73il@xxxxxxxxx> > > Date: Tue, 22 Jan 2019 07:01:39 +0200 > > Subject: ovl: fix missing upper fs freeze protection on copy up for ioctl > > > > From: Amir Goldstein <amir73il@xxxxxxxxx> > > > > commit 3428030da004a1128cbdcf93dc03e16f184d845b upstream. > > > > Generalize the helper ovl_open_maybe_copy_up() and use it to copy up file > > with data before FS_IOC_SETFLAGS ioctl. > > > > The FS_IOC_SETFLAGS ioctl is a bit of an odd ball in vfs, which probably > > caused the confusion. File may be open O_RDONLY, but ioctl modifies the > > file. VFS does not call mnt_want_write_file() nor lock inode mutex, but > > fs-specific code for FS_IOC_SETFLAGS does. So ovl_ioctl() calls > > mnt_want_write_file() for the overlay file, and fs-specific code calls > > mnt_want_write_file() for upper fs file, but there was no call for > > ovl_want_write() for copy up duration which prevents overlayfs from copying > > up on a frozen upper fs. > > > > Fixes: dab5ca8fd9dd ("ovl: add lsattr/chattr support") > > Cc: <stable@xxxxxxxxxxxxxxx> # v4.19 > > Signed-off-by: Amir Goldstein <amir73il@xxxxxxxxx> > > Acked-by: Vivek Goyal <vgoyal@xxxxxxxxxx> > > Signed-off-by: Miklos Szeredi <mszeredi@xxxxxxxxxx> > > Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> > > > > --- > > fs/overlayfs/copy_up.c | 6 +++--- > > fs/overlayfs/file.c | 5 ++--- > > fs/overlayfs/overlayfs.h | 2 +- > > 3 files changed, 6 insertions(+), 7 deletions(-) > > > > --- a/fs/overlayfs/copy_up.c > > +++ b/fs/overlayfs/copy_up.c > > @@ -878,14 +878,14 @@ static bool ovl_open_need_copy_up(struct > > return true; > > } > > > > -int ovl_open_maybe_copy_up(struct dentry *dentry, unsigned int file_flags) > > +int ovl_maybe_copy_up(struct dentry *dentry, int flags) > > { > > int err = 0; > > > > - if (ovl_open_need_copy_up(dentry, file_flags)) { > > + if (ovl_open_need_copy_up(dentry, flags)) { > > err = ovl_want_write(dentry); > > if (!err) { > > - err = ovl_copy_up_flags(dentry, file_flags); > > + err = ovl_copy_up_flags(dentry, flags); > > ovl_drop_write(dentry); > > } > > } > > --- a/fs/overlayfs/file.c > > +++ b/fs/overlayfs/file.c > > @@ -116,11 +116,10 @@ static int ovl_real_fdget(const struct f > > > > static int ovl_open(struct inode *inode, struct file *file) > > { > > - struct dentry *dentry = file_dentry(file); > > struct file *realfile; > > int err; > > > > - err = ovl_open_maybe_copy_up(dentry, file->f_flags); > > + err = ovl_maybe_copy_up(file_dentry(file), file->f_flags); > > if (err) > > return err; > > > > @@ -390,7 +389,7 @@ static long ovl_ioctl(struct file *file, > > if (ret) > > return ret; > > > > - ret = ovl_copy_up_with_data(file_dentry(file)); > > + ret = ovl_maybe_copy_up(file_dentry(file), O_WRONLY); > > if (!ret) { > > ret = ovl_real_ioctl(file, cmd, arg); > > > > --- a/fs/overlayfs/overlayfs.h > > +++ b/fs/overlayfs/overlayfs.h > > @@ -411,7 +411,7 @@ extern const struct file_operations ovl_ > > int ovl_copy_up(struct dentry *dentry); > > int ovl_copy_up_with_data(struct dentry *dentry); > > int ovl_copy_up_flags(struct dentry *dentry, int flags); > > -int ovl_open_maybe_copy_up(struct dentry *dentry, unsigned int file_flags); > > +int ovl_maybe_copy_up(struct dentry *dentry, int flags); > > int ovl_copy_xattr(struct dentry *old, struct dentry *new); > > int ovl_set_attr(struct dentry *upper, struct kstat *stat); > > struct ovl_fh *ovl_encode_real_fh(struct dentry *real, bool is_upper); > > > > > > Patches currently in stable-queue which might be from amir73il@xxxxxxxxx are > > > > queue-4.19/ovl-fix-missing-upper-fs-freeze-protection-on-copy-up-for-ioctl.patch > > This patch is fine for stable, but I have a process question. > All these patches from overlayfs 5.2-rc1 are also v4.9 stable candidates: > > 1. acf3062a7e1c - ovl: relax WARN_ON() for overlapping layers use case > 2. 98487de318a6 - ovl: check the capability before cred overridden > 3. d989903058a8 - ovl: do not generate duplicate fsnotify events for "fake" path > 4. 9e46b840c705 - ovl: support stacked SEEK_HOLE/SEEK_DATA > > #2 wasn't properly marked for stable, but the other are marked with > Fixes: and Reported-by: > > Are those marks not sufficient to get selected for stable trees these days? Not by default, no. Sometimes they might get picked up if we get bored, or the auto-bot notices them. > I must admit that #1 in borderline stable. Not sure if eliminating an unjust > WARN_ON qualified, but syzbot did report a bug.. syzbot things are good to fix in stable kernels, so that syzbot can continue to find real things in stable kernels. So yes, that is fine to backport. > Just asking in order to improve the process, but in any case, > please pick those patches for v4.9+ (unless anyone objects?) > They all already have LTP/xfstests/syzkaller tests that cover them. I'll queue them up for the next round after this, thanks. greg k-h
