Re: [PATCH 7.1 625/744] ceph: add owner/capability checks for CEPH_IOC_SET_LAYOUT*

On Thu, Jul 30, 2026 at 07:39:26PM +0200, Ilya Dryomov wrote:
> On Thu, Jul 30, 2026 at 4:49 PM Greg Kroah-Hartman
> <[email protected]> wrote:
> >
> > 7.1-stable review patch.  If anyone has any objections, please let me know.
> >
> > ------------------
> >
> > From: Max Kellermann <[email protected]>
> >
> > commit cee38bbf5556a8e0a232ccae41649580827d7806 upstream.
> >
> > These permission checks were already missing in the initial
> > impementation of these ioctls.  This Ceph allows any user who owns a
> > file descriptor to manipulate the layout of any file, even if they
> > don't have write permissions.
> >
> > It might be a good idea to guard other ioctls with permission checks
> > as well or even disallow regular users (even if they own the file) to
> > manipulate layout settings completely, as this may be abused to DoS
> > the Ceph servers, but right now, I find it most urgent to have setter
> > checks at all.
> >
> > Cc: [email protected]
> > Fixes: 8f4e91dee2a2 ("ceph: ioctls")
> > Signed-off-by: Max Kellermann <[email protected]>
> > Reviewed-by: Xiubo Li <[email protected]>
> > Signed-off-by: Ilya Dryomov <[email protected]>
> > Signed-off-by: Greg Kroah-Hartman <[email protected]>
> > ---
> >  fs/ceph/ioctl.c |    6 ++++++
> >  1 file changed, 6 insertions(+)
> >
> > --- a/fs/ceph/ioctl.c
> > +++ b/fs/ceph/ioctl.c
> > @@ -72,6 +72,9 @@ static long ceph_ioctl_set_layout(struct
> >         struct ceph_ioctl_layout nl;
> >         int err;
> >
> > +       if (!inode_owner_or_capable(&nop_mnt_idmap, inode))
> > +               return -EACCES;
> > +
> >         if (copy_from_user(&l, arg, sizeof(l)))
> >                 return -EFAULT;
> >
> > @@ -142,6 +145,9 @@ static long ceph_ioctl_set_layout_policy
> >         int err;
> >         struct ceph_mds_client *mdsc = ceph_sb_to_fs_client(inode->i_sb)->mdsc;
> >
> > +       if (!inode_owner_or_capable(&nop_mnt_idmap, inode))
> > +               return -EACCES;
> > +
> >         /* copy and validate */
> >         if (copy_from_user(&l, arg, sizeof(l)))
> >                 return -EFAULT;
> >
> >
> 
> Hi Greg,
> 
> There is a concern about the correctness of this patch, please drop it
> for now.

Ok, dropped now from all branches.  If you want it back, please let us
know in the future.

thanks,

greg k-h