From 87c9e88ac4a16a7aba99862c41b33d7eeb75d375 Mon Sep 17 00:00:00 2001 From: Christian Brauner Date: Fri, 5 Dec 2025 13:10:48 +0100 Subject: [PATCH] ovl: pass original credentials, not mounter credentials during create When creating new files the security layer expects the original credentials to be passed. When cleaning up the code this was accidently changed to pass the mounter's credentials by relying on current->cred which is already overriden at this point. Pass the original credentials directly. Reported-by: Ondrej Mosnacek Reported-by: Paul Moore Fixes: e566bff96322 ("ovl: port ovl_create_or_link() to new ovl_override_creator_creds") Link: https://lore.kernel.org/CAFqZXNvL1ciLXMhHrnoyBmQu1PAApH41LkSWEhrcvzAAbFij8Q@mail.gmail.com Signed-off-by: Christian Brauner Tested-by: Ondrej Mosnacek Reviewed-by: Amir Goldstein Signed-off-by: Linus Torvalds --- fs/overlayfs/dir.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c index 06b860b9ded6b..ff3dbd1ca61f2 100644 --- a/fs/overlayfs/dir.c +++ b/fs/overlayfs/dir.c @@ -581,7 +581,8 @@ out_cleanup_unlocked: goto out_dput; } -static const struct cred *ovl_override_creator_creds(struct dentry *dentry, struct inode *inode, umode_t mode) +static const struct cred *ovl_override_creator_creds(const struct cred *original_creds, + struct dentry *dentry, struct inode *inode, umode_t mode) { int err; @@ -596,7 +597,7 @@ static const struct cred *ovl_override_creator_creds(struct dentry *dentry, stru override_cred->fsgid = inode->i_gid; err = security_dentry_create_files_as(dentry, mode, &dentry->d_name, - current->cred, override_cred); + original_creds, override_cred); if (err) return ERR_PTR(err); @@ -614,8 +615,11 @@ static void ovl_revert_creator_creds(const struct cred *old_cred) DEFINE_CLASS(ovl_override_creator_creds, const struct cred *, if (!IS_ERR_OR_NULL(_T)) ovl_revert_creator_creds(_T), - ovl_override_creator_creds(dentry, inode, mode), - struct dentry *dentry, struct inode *inode, umode_t mode) + ovl_override_creator_creds(original_creds, dentry, inode, mode), + const struct cred *original_creds, + struct dentry *dentry, + struct inode *inode, + umode_t mode) static int ovl_create_handle_whiteouts(struct dentry *dentry, struct inode *inode, @@ -633,7 +637,7 @@ static int ovl_create_or_link(struct dentry *dentry, struct inode *inode, int err; struct dentry *parent = dentry->d_parent; - with_ovl_creds(dentry->d_sb) { + scoped_class(override_creds_ovl, original_creds, dentry->d_sb) { /* * When linking a file with copy up origin into a new parent, mark the * new parent dir "impure". @@ -661,7 +665,7 @@ static int ovl_create_or_link(struct dentry *dentry, struct inode *inode, if (attr->hardlink) return ovl_create_handle_whiteouts(dentry, inode, attr); - scoped_class(ovl_override_creator_creds, cred, dentry, inode, attr->mode) { + scoped_class(ovl_override_creator_creds, cred, original_creds, dentry, inode, attr->mode) { if (IS_ERR(cred)) return PTR_ERR(cred); return ovl_create_handle_whiteouts(dentry, inode, attr); @@ -1364,8 +1368,8 @@ static int ovl_create_tmpfile(struct file *file, struct dentry *dentry, int flags = file->f_flags | OVL_OPEN_FLAGS; int err; - with_ovl_creds(dentry->d_sb) { - scoped_class(ovl_override_creator_creds, cred, dentry, inode, mode) { + scoped_class(override_creds_ovl, original_creds, dentry->d_sb) { + scoped_class(ovl_override_creator_creds, cred, original_creds, dentry, inode, mode) { if (IS_ERR(cred)) return PTR_ERR(cred); -- 2.47.3