Merge tag 'fuse-update-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse

Pull fuse updates from Miklos Szeredi: - Fix an issue with reusing the bdi in case of block based filesystems - Allow root (in init namespace) to access fuse filesystems in user namespaces if expicitly enabled with a module param - Misc fixes * tag 'fuse-update-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: fuse: retire block-device-based superblock on force unmount vfs: function to prevent re-use of block-device-based superblocks virtio_fs: Modify format for virtio_fs_direct_access virtiofs: delete unused parameter for virtio_fs_cleanup_vqs fuse: Add module param for CAP_SYS_ADMIN access bypassing allow_other fuse: Remove the control interface for virtio-fs fuse: ioctl: translate ENOSYS fuse: limit nsec fuse: avoid unnecessary spinlock bump fuse: fix deadlock between atomic O_TRUNC and page invalidation fuse: write inode in fuse_release()

Linus Torvalds committed 4 years ago

Commit 2bd5d412 parents 65512eb 247861c10 files · +132 −33Browse files

Unified · Split

10 files

Documentation/filesystems/fuse.rst +24 −5
fs/fuse/control.c +2 −2
fs/fuse/dax.c +1 −1
fs/fuse/dir.c +15 −1
fs/fuse/file.c +26 −13
fs/fuse/inode.c +14 −2
fs/fuse/ioctl.c +13 −2
fs/fuse/virtio_fs.c +4 −5
fs/super.c +31 −2
include/linux/fs.h +2 −0

Documentation/filesystems/fuse.rst+24−5

@@ -279,7 +279,7 @@ How are requirements fulfilled? · 278 unmodified lines
279	the filesystem or not.	279	the filesystem or not.
280		280
281	Note that the ptrace check is not strictly necessary to	281	Note that the ptrace check is not strictly necessary to
282	prevent B/2/i, it is enough to check if mount owner has enough	282	prevent C/2/i, it is enough to check if mount owner has enough
283	privilege to send signal to the process accessing the	283	privilege to send signal to the process accessing the
284	filesystem, since SIGSTOP can be used to get a similar effect.	284	filesystem, since SIGSTOP can be used to get a similar effect.
285		285
@@ -288,10 +288,29 @@ I think these limitations are unacceptable? · 2 unmodified lines
288		288
289	If a sysadmin trusts the users enough, or can ensure through other	289	If a sysadmin trusts the users enough, or can ensure through other
290	measures, that system processes will never enter non-privileged	290	measures, that system processes will never enter non-privileged
291	mounts, it can relax the last limitation with a 'user_allow_other'	291	mounts, it can relax the last limitation in several ways:
292	config option. If this config option is set, the mounting user can	292
293	add the 'allow_other' mount option which disables the check for other	293	- With the 'user_allow_other' config option. If this config option is
294	users' processes.	294	set, the mounting user can add the 'allow_other' mount option which
		295	disables the check for other users' processes.
		296
		297	User namespaces have an unintuitive interaction with 'allow_other':
		298	an unprivileged user - normally restricted from mounting with
		299	'allow_other' - could do so in a user namespace where they're
		300	privileged. If any process could access such an 'allow_other' mount
		301	this would give the mounting user the ability to manipulate
		302	processes in user namespaces where they're unprivileged. For this
		303	reason 'allow_other' restricts access to users in the same userns
		304	or a descendant.
		305
		306	- With the 'allow_sys_admin_access' module option. If this option is
		307	set, super user's processes have unrestricted access to mounts
		308	irrespective of allow_other setting or user namespace of the
		309	mounting user.
		310
		311	Note that both of these relaxations expose the system to potential
		312	information leak or DoS as described in points B and C/2/i-ii in the
		313	preceding section.
295		314
296	Kernel - userspace interface	315	Kernel - userspace interface
297	============================	316	============================

fs/fuse/control.c+2−2

@@ -258,7 +258,7 @@ int fuse_ctl_add_conn(struct fuse_conn *fc) · 257 unmodified lines
258	struct dentry *parent;	258	struct dentry *parent;
259	char name[32];	259	char name[32];
260		260
261	if (!fuse_control_sb)	261	if (!fuse_control_sb \|\| fc->no_control)
262	return 0;	262	return 0;
263		263
264	parent = fuse_control_sb->s_root;	264	parent = fuse_control_sb->s_root;
@@ -296,7 +296,7 @@ void fuse_ctl_remove_conn(struct fuse_conn *fc) · 31 unmodified lines
296	{	296	{
297	int i;	297	int i;
298		298
299	if (!fuse_control_sb)	299	if (!fuse_control_sb \|\| fc->no_control)
300	return;	300	return;
301		301
302	for (i = fc->ctl_ndents - 1; i >= 0; i--) {	302	for (i = fc->ctl_ndents - 1; i >= 0; i--) {

fs/fuse/dax.c+1−1

 		WARN_ON(fcd->nr_free_ranges <= 0);
 		fcd->nr_free_ranges--;
 	}
+	__kick_dmap_free_worker(fcd, 0);
 	spin_unlock(&fcd->lock);
-	kick_dmap_free_worker(fcd, 0);
 	return dmap;
 }

fs/fuse/dir.c+15−1

 #include <linux/pagemap.h>
 #include <linux/file.h>
 #include <linux/fs_context.h>
+#include <linux/moduleparam.h>
 #include <linux/sched.h>
 #include <linux/namei.h>
 #include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
+static bool __read_mostly allow_sys_admin_access;
+module_param(allow_sys_admin_access, bool, 0644);
+MODULE_PARM_DESC(allow_sys_admin_access,
+		 "Allow users with CAP_SYS_ADMIN in initial userns to bypass allow_other access check");
 static void fuse_advise_use_readdirplus(struct inode *dir)
 {
 	struct fuse_inode *fi = get_fuse_inode(dir);
 	struct fuse_file *ff;
 	void *security_ctx = NULL;
 	u32 security_ctxlen;
+	bool trunc = flags & O_TRUNC;
 	/* Userspace expects S_IFREG in create mode */
 	BUG_ON((mode & S_IFMT) != S_IFREG);
 	inarg.mode = mode;
 	inarg.umask = current_umask();
-	if (fm->fc->handle_killpriv_v2 && (flags & O_TRUNC) &&
+	if (fm->fc->handle_killpriv_v2 && trunc &&
 	    !(flags & O_EXCL) && !capable(CAP_FSETID)) {
 		inarg.open_flags |= FUSE_OPEN_KILL_SUIDGID;
 	}
 	} else {
 		file->private_data = ff;
 		fuse_finish_open(inode, file);
+		if (fm->fc->atomic_o_trunc && trunc)
+			truncate_pagecache(inode, 0);
+		else if (!(ff->open_flags & FOPEN_KEEP_CACHE))
+			invalidate_inode_pages2(inode->i_mapping);
 	}
 	return err;
 {
 	const struct cred *cred;
+	if (allow_sys_admin_access && capable(CAP_SYS_ADMIN))
+		return 1;
 	if (fc->allow_other)
 		return current_in_userns(fc->user_ns);

fs/fuse/file.c+26−13

@@ -210,13 +210,9 @@ void fuse_finish_open(struct inode inode, struct file file) · 209 unmodified lines
210	fi->attr_version = atomic64_inc_return(&fc->attr_version);	210	fi->attr_version = atomic64_inc_return(&fc->attr_version);
211	i_size_write(inode, 0);	211	i_size_write(inode, 0);
212	spin_unlock(&fi->lock);	212	spin_unlock(&fi->lock);
213	truncate_pagecache(inode, 0);
214	file_update_time(file);	213	file_update_time(file);
215	fuse_invalidate_attr_mask(inode, FUSE_STATX_MODSIZE);	214	fuse_invalidate_attr_mask(inode, FUSE_STATX_MODSIZE);
216	} else if (!(ff->open_flags & FOPEN_KEEP_CACHE)) {
217	invalidate_inode_pages2(inode->i_mapping);
218	}	215	}
219
220	if ((file->f_mode & FMODE_WRITE) && fc->writeback_cache)	216	if ((file->f_mode & FMODE_WRITE) && fc->writeback_cache)
221	fuse_link_write_file(file);	217	fuse_link_write_file(file);
222	}	218	}
@@ -239,30 +235,38 @@ int fuse_open_common(struct inode inode, struct file file, bool isdir) · 16 unmodified lines
239	if (err)	235	if (err)
240	return err;	236	return err;
241		237
242	if (is_wb_truncate \|\| dax_truncate) {	238	if (is_wb_truncate \|\| dax_truncate)
243	inode_lock(inode);	239	inode_lock(inode);
244	fuse_set_nowrite(inode);
245	}
246		240
247	if (dax_truncate) {	241	if (dax_truncate) {
248	filemap_invalidate_lock(inode->i_mapping);	242	filemap_invalidate_lock(inode->i_mapping);
249	err = fuse_dax_break_layouts(inode, 0, 0);	243	err = fuse_dax_break_layouts(inode, 0, 0);
250	if (err)	244	if (err)
251	goto out;	245	goto out_inode_unlock;
252	}	246	}
253		247
		248	if (is_wb_truncate \|\| dax_truncate)
		249	fuse_set_nowrite(inode);
		250
254	err = fuse_do_open(fm, get_node_id(inode), file, isdir);	251	err = fuse_do_open(fm, get_node_id(inode), file, isdir);
255	if (!err)	252	if (!err)
256	fuse_finish_open(inode, file);	253	fuse_finish_open(inode, file);
257		254
258	out:	255	if (is_wb_truncate \|\| dax_truncate)
		256	fuse_release_nowrite(inode);
		257	if (!err) {
		258	struct fuse_file *ff = file->private_data;
		259
		260	if (fc->atomic_o_trunc && (file->f_flags & O_TRUNC))
		261	truncate_pagecache(inode, 0);
		262	else if (!(ff->open_flags & FOPEN_KEEP_CACHE))
		263	invalidate_inode_pages2(inode->i_mapping);
		264	}
259	if (dax_truncate)	265	if (dax_truncate)
260	filemap_invalidate_unlock(inode->i_mapping);	266	filemap_invalidate_unlock(inode->i_mapping);
261		267	out_inode_unlock:
262	if (is_wb_truncate \| dax_truncate) {	268	if (is_wb_truncate \|\| dax_truncate)
263	fuse_release_nowrite(inode);
264	inode_unlock(inode);	269	inode_unlock(inode);
265	}
266		270
267	return err;	271	return err;
268	}	272	}
@@ -338,6 +342,15 @@ static int fuse_open(struct inode inode, struct file file) · 69 unmodified lines
338		342
339	static int fuse_release(struct inode inode, struct file file)	343	static int fuse_release(struct inode inode, struct file file)
340	{	344	{
		345	struct fuse_conn *fc = get_fuse_conn(inode);
		346
		347	/*
		348	* Dirty pages might remain despite write_inode_now() call from
		349	* fuse_flush() due to writes racing with the close.
		350	*/
		351	if (fc->writeback_cache)
		352	write_inode_now(inode, 1);
		353
341	fuse_release_common(file, false);	354	fuse_release_common(file, false);
342		355
343	/* return value is ignored by VFS */	356	/* return value is ignored by VFS */

fs/fuse/inode.c+14−2

 	inode->i_uid     = make_kuid(fc->user_ns, attr->uid);
 	inode->i_gid     = make_kgid(fc->user_ns, attr->gid);
 	inode->i_blocks  = attr->blocks;
+	/* Sanitize nsecs */
+	attr->atimensec = min_t(u32, attr->atimensec, NSEC_PER_SEC - 1);
+	attr->mtimensec = min_t(u32, attr->mtimensec, NSEC_PER_SEC - 1);
+	attr->ctimensec = min_t(u32, attr->ctimensec, NSEC_PER_SEC - 1);
 	inode->i_atime.tv_sec   = attr->atime;
 	inode->i_atime.tv_nsec  = attr->atimensec;
 	/* mtime from server may be stale due to local buffered write */
 {
 	struct fuse_conn *fc = get_fuse_conn_super(sb);
-	if (!fc->no_force_umount)
+	if (fc->no_force_umount)
-		fuse_abort_conn(fc);
+		return;
+	fuse_abort_conn(fc);
+	// Only retire block-device-based superblocks.
+	if (sb->s_bdev != NULL)
+		retire_super(sb);
 }
 static void fuse_send_destroy(struct fuse_mount *fm)

fs/fuse/ioctl.c+13−2

 #include <linux/compat.h>
 #include <linux/fileattr.h>
+static ssize_t fuse_send_ioctl(struct fuse_mount *fm, struct fuse_args *args)
+{
+	ssize_t ret = fuse_simple_request(fm, args);
+	/* Translate ENOSYS, which shouldn't be returned from fs */
+	if (ret == -ENOSYS)
+		ret = -ENOTTY;
+	return ret;
+}
 /*
  * CUSE servers compiled on 32bit broke on 64bit kernels because the
  * ABI was defined to be 'struct iovec' which is different on 32bit
 	ap.args.out_pages = true;
 	ap.args.out_argvar = true;
-	transferred = fuse_simple_request(fm, &ap.args);
+	transferred = fuse_send_ioctl(fm, &ap.args);
 	err = transferred;
 	if (transferred < 0)
 		goto out;
 	args.out_args[1].size = inarg.out_size;
 	args.out_args[1].value = ptr;
-	err = fuse_simple_request(fm, &args);
+	err = fuse_send_ioctl(fm, &args);
 	if (!err) {
 		if (outarg.result < 0)
 			err = outarg.result;

fs/fuse/virtio_fs.c+4−5

 }
 /* Free virtqueues (device must already be reset) */
-static void virtio_fs_cleanup_vqs(struct virtio_device *vdev,
+static void virtio_fs_cleanup_vqs(struct virtio_device *vdev)
-				  struct virtio_fs *fs)
 {
 	vdev->config->del_vqs(vdev);
 }
 {
 	struct virtio_fs *fs = dax_get_private(dax_dev);
 	phys_addr_t offset = PFN_PHYS(pgoff);
-	size_t max_nr_pages = fs->window_len/PAGE_SIZE - pgoff;
+	size_t max_nr_pages = fs->window_len / PAGE_SIZE - pgoff;
 	if (kaddr)
 		*kaddr = fs->window_kaddr + offset;
 out_vqs:
 	virtio_reset_device(vdev);
-	virtio_fs_cleanup_vqs(vdev, fs);
+	virtio_fs_cleanup_vqs(vdev);
 	kfree(fs->vqs);
 out:
 	virtio_fs_stop_all_queues(fs);
 	virtio_fs_drain_all_queues_locked(fs);
 	virtio_reset_device(vdev);
-	virtio_fs_cleanup_vqs(vdev, fs);
+	virtio_fs_cleanup_vqs(vdev);
 	vdev->priv = NULL;
 	/* Put device reference on virtio_fs object */

fs/super.c+31−2

@@ -422,6 +422,35 @@ bool trylock_super(struct super_block *sb) · 421 unmodified lines
422	return false;	422	return false;
423	}	423	}
424		424
		425	/**
		426	* retire_super - prevents superblock from being reused
		427	* @sb: superblock to retire
		428	*
		429	* The function marks superblock to be ignored in superblock test, which
		430	* prevents it from being reused for any new mounts. If the superblock has
		431	* a private bdi, it also unregisters it, but doesn't reduce the refcount
		432	* of the superblock to prevent potential races. The refcount is reduced
		433	* by generic_shutdown_super(). The function can not be called
		434	* concurrently with generic_shutdown_super(). It is safe to call the
		435	* function multiple times, subsequent calls have no effect.
		436	*
		437	* The marker will affect the re-use only for block-device-based
		438	* superblocks. Other superblocks will still get marked if this function
		439	* is used, but that will not affect their reusability.
		440	*/
		441	void retire_super(struct super_block *sb)
		442	{
		443	WARN_ON(!sb->s_bdev);
		444	down_write(&sb->s_umount);
		445	if (sb->s_iflags & SB_I_PERSB_BDI) {
		446	bdi_unregister(sb->s_bdi);
		447	sb->s_iflags &= ~SB_I_PERSB_BDI;
		448	}
		449	sb->s_iflags \|= SB_I_RETIRED;
		450	up_write(&sb->s_umount);
		451	}
		452	EXPORT_SYMBOL(retire_super);
		453
425	/**	454	/**
426	* generic_shutdown_super - common helper for ->kill_sb()	455	* generic_shutdown_super - common helper for ->kill_sb()
427	* @sb: superblock to kill	456	* @sb: superblock to kill
@@ -1216,7 +1245,7 @@ static int set_bdev_super_fc(struct super_block s, struct fs_context fc) · 788 unmodified lines
1216		1245
1217	static int test_bdev_super_fc(struct super_block s, struct fs_context fc)	1246	static int test_bdev_super_fc(struct super_block s, struct fs_context fc)
1218	{	1247	{
1219	return s->s_bdev == fc->sget_key;	1248	return !(s->s_iflags & SB_I_RETIRED) && s->s_bdev == fc->sget_key;
1220	}	1249	}
1221		1250
1222	/**	1251	/**
@@ -1309,7 +1338,7 @@ EXPORT_SYMBOL(get_tree_bdev); · 86 unmodified lines
1309		1338
1310	static int test_bdev_super(struct super_block s, void data)	1339	static int test_bdev_super(struct super_block s, void data)
1311	{	1340	{
1312	return (void *)s->s_bdev == data;	1341	return !(s->s_iflags & SB_I_RETIRED) && (void *)s->s_bdev == data;
1313	}	1342	}
1314		1343
1315	struct dentry mount_bdev(struct file_system_type fs_type,	1344	struct dentry mount_bdev(struct file_system_type fs_type,

include/linux/fs.h+2−0

 #define SB_I_SKIP_SYNC	0x00000100	/* Skip superblock at global sync */
 #define SB_I_PERSB_BDI	0x00000200	/* has a per-sb bdi */
 #define SB_I_TS_EXPIRY_WARNED 0x00000400 /* warned about timestamp range expiry */
+#define SB_I_RETIRED	0x00000800	/* superblock shouldn't be reused */
 /* Possible states of 'frozen' field */
 enum {
 	int flags, void *data,
 	int (*fill_super)(struct super_block *, void *, int));
 extern struct dentry *mount_subtree(struct vfsmount *mnt, const char *path);
+void retire_super(struct super_block *sb);
 void generic_shutdown_super(struct super_block *sb);
 void kill_block_super(struct super_block *sb);
 void kill_anon_super(struct super_block *sb);

Merge tag 'fuse-update-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code