From: Greg Kroah-Hartman Date: Fri, 31 Jul 2026 06:45:33 +0000 (+0200) Subject: remove ceph patch on request X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2414f1ce2aeae41a5300e858db573bbc22cf13ae;p=thirdparty%2Fkernel%2Fstable-queue.git remove ceph patch on request --- diff --git a/queue-6.12/ceph-add-owner-capability-checks-for-ceph_ioc_set_layout.patch b/queue-6.12/ceph-add-owner-capability-checks-for-ceph_ioc_set_layout.patch deleted file mode 100644 index d5495018dc..0000000000 --- a/queue-6.12/ceph-add-owner-capability-checks-for-ceph_ioc_set_layout.patch +++ /dev/null @@ -1,52 +0,0 @@ -From cee38bbf5556a8e0a232ccae41649580827d7806 Mon Sep 17 00:00:00 2001 -From: Max Kellermann -Date: Tue, 21 Jul 2026 08:20:46 +0200 -Subject: ceph: add owner/capability checks for CEPH_IOC_SET_LAYOUT* - -From: Max Kellermann - -commit cee38bbf5556a8e0a232ccae41649580827d7806 upstream. - -These permission checks were already missing in the initial -impementation of these ioctls. This Ceph allows any user who owns a -file descriptor to manipulate the layout of any file, even if they -don't have write permissions. - -It might be a good idea to guard other ioctls with permission checks -as well or even disallow regular users (even if they own the file) to -manipulate layout settings completely, as this may be abused to DoS -the Ceph servers, but right now, I find it most urgent to have setter -checks at all. - -Cc: stable@vger.kernel.org -Fixes: 8f4e91dee2a2 ("ceph: ioctls") -Signed-off-by: Max Kellermann -Reviewed-by: Xiubo Li -Signed-off-by: Ilya Dryomov -Signed-off-by: Greg Kroah-Hartman ---- - fs/ceph/ioctl.c | 6 ++++++ - 1 file changed, 6 insertions(+) - ---- a/fs/ceph/ioctl.c -+++ b/fs/ceph/ioctl.c -@@ -72,6 +72,9 @@ static long ceph_ioctl_set_layout(struct - struct ceph_ioctl_layout nl; - int err; - -+ if (!inode_owner_or_capable(&nop_mnt_idmap, inode)) -+ return -EACCES; -+ - if (copy_from_user(&l, arg, sizeof(l))) - return -EFAULT; - -@@ -142,6 +145,9 @@ static long ceph_ioctl_set_layout_policy - int err; - struct ceph_mds_client *mdsc = ceph_sb_to_fs_client(inode->i_sb)->mdsc; - -+ if (!inode_owner_or_capable(&nop_mnt_idmap, inode)) -+ return -EACCES; -+ - /* copy and validate */ - if (copy_from_user(&l, arg, sizeof(l))) - return -EFAULT; diff --git a/queue-6.12/series b/queue-6.12/series index 6c5f5ed764..b9b98ff15e 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -386,7 +386,6 @@ mptcp-only-set-data_fin-when-a-mapping-is-present.patch sctp-don-t-free-the-asconf-s-own-transport-in-del-ip-processing.patch sctp-avoid-auth_enable-sysctl-uaf-during-netns-teardown.patch sctp-close-udp-tunnel-sockets-during-netns-teardown.patch -ceph-add-owner-capability-checks-for-ceph_ioc_set_layout.patch ceph-fix-pre-auth-out-of-bounds-read-on-snaptrace-in-ceph_handle_caps.patch ceph-fix-refcount-leak-in-ceph_readdir.patch libceph-bound-get_version-reply-decode-to-front-len.patch diff --git a/queue-6.18/ceph-add-owner-capability-checks-for-ceph_ioc_set_layout.patch b/queue-6.18/ceph-add-owner-capability-checks-for-ceph_ioc_set_layout.patch deleted file mode 100644 index d5495018dc..0000000000 --- a/queue-6.18/ceph-add-owner-capability-checks-for-ceph_ioc_set_layout.patch +++ /dev/null @@ -1,52 +0,0 @@ -From cee38bbf5556a8e0a232ccae41649580827d7806 Mon Sep 17 00:00:00 2001 -From: Max Kellermann -Date: Tue, 21 Jul 2026 08:20:46 +0200 -Subject: ceph: add owner/capability checks for CEPH_IOC_SET_LAYOUT* - -From: Max Kellermann - -commit cee38bbf5556a8e0a232ccae41649580827d7806 upstream. - -These permission checks were already missing in the initial -impementation of these ioctls. This Ceph allows any user who owns a -file descriptor to manipulate the layout of any file, even if they -don't have write permissions. - -It might be a good idea to guard other ioctls with permission checks -as well or even disallow regular users (even if they own the file) to -manipulate layout settings completely, as this may be abused to DoS -the Ceph servers, but right now, I find it most urgent to have setter -checks at all. - -Cc: stable@vger.kernel.org -Fixes: 8f4e91dee2a2 ("ceph: ioctls") -Signed-off-by: Max Kellermann -Reviewed-by: Xiubo Li -Signed-off-by: Ilya Dryomov -Signed-off-by: Greg Kroah-Hartman ---- - fs/ceph/ioctl.c | 6 ++++++ - 1 file changed, 6 insertions(+) - ---- a/fs/ceph/ioctl.c -+++ b/fs/ceph/ioctl.c -@@ -72,6 +72,9 @@ static long ceph_ioctl_set_layout(struct - struct ceph_ioctl_layout nl; - int err; - -+ if (!inode_owner_or_capable(&nop_mnt_idmap, inode)) -+ return -EACCES; -+ - if (copy_from_user(&l, arg, sizeof(l))) - return -EFAULT; - -@@ -142,6 +145,9 @@ static long ceph_ioctl_set_layout_policy - int err; - struct ceph_mds_client *mdsc = ceph_sb_to_fs_client(inode->i_sb)->mdsc; - -+ if (!inode_owner_or_capable(&nop_mnt_idmap, inode)) -+ return -EACCES; -+ - /* copy and validate */ - if (copy_from_user(&l, arg, sizeof(l))) - return -EFAULT; diff --git a/queue-6.18/series b/queue-6.18/series index 33c8df8095..d7ccc263ab 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -507,7 +507,6 @@ mm-huge_memory-set-pg_has_hwpoisoned-only-after-new-folio-head-is-established.pa sctp-don-t-free-the-asconf-s-own-transport-in-del-ip-processing.patch sctp-avoid-auth_enable-sysctl-uaf-during-netns-teardown.patch sctp-close-udp-tunnel-sockets-during-netns-teardown.patch -ceph-add-owner-capability-checks-for-ceph_ioc_set_layout.patch ceph-fix-pre-auth-out-of-bounds-read-on-snaptrace-in-ceph_handle_caps.patch ceph-fix-refcount-leak-in-ceph_readdir.patch ceph-fix-writeback_count-leak-in-write_folio_nounlock.patch diff --git a/queue-7.1/ceph-add-owner-capability-checks-for-ceph_ioc_set_layout.patch b/queue-7.1/ceph-add-owner-capability-checks-for-ceph_ioc_set_layout.patch deleted file mode 100644 index d5495018dc..0000000000 --- a/queue-7.1/ceph-add-owner-capability-checks-for-ceph_ioc_set_layout.patch +++ /dev/null @@ -1,52 +0,0 @@ -From cee38bbf5556a8e0a232ccae41649580827d7806 Mon Sep 17 00:00:00 2001 -From: Max Kellermann -Date: Tue, 21 Jul 2026 08:20:46 +0200 -Subject: ceph: add owner/capability checks for CEPH_IOC_SET_LAYOUT* - -From: Max Kellermann - -commit cee38bbf5556a8e0a232ccae41649580827d7806 upstream. - -These permission checks were already missing in the initial -impementation of these ioctls. This Ceph allows any user who owns a -file descriptor to manipulate the layout of any file, even if they -don't have write permissions. - -It might be a good idea to guard other ioctls with permission checks -as well or even disallow regular users (even if they own the file) to -manipulate layout settings completely, as this may be abused to DoS -the Ceph servers, but right now, I find it most urgent to have setter -checks at all. - -Cc: stable@vger.kernel.org -Fixes: 8f4e91dee2a2 ("ceph: ioctls") -Signed-off-by: Max Kellermann -Reviewed-by: Xiubo Li -Signed-off-by: Ilya Dryomov -Signed-off-by: Greg Kroah-Hartman ---- - fs/ceph/ioctl.c | 6 ++++++ - 1 file changed, 6 insertions(+) - ---- a/fs/ceph/ioctl.c -+++ b/fs/ceph/ioctl.c -@@ -72,6 +72,9 @@ static long ceph_ioctl_set_layout(struct - struct ceph_ioctl_layout nl; - int err; - -+ if (!inode_owner_or_capable(&nop_mnt_idmap, inode)) -+ return -EACCES; -+ - if (copy_from_user(&l, arg, sizeof(l))) - return -EFAULT; - -@@ -142,6 +145,9 @@ static long ceph_ioctl_set_layout_policy - int err; - struct ceph_mds_client *mdsc = ceph_sb_to_fs_client(inode->i_sb)->mdsc; - -+ if (!inode_owner_or_capable(&nop_mnt_idmap, inode)) -+ return -EACCES; -+ - /* copy and validate */ - if (copy_from_user(&l, arg, sizeof(l))) - return -EFAULT; diff --git a/queue-7.1/series b/queue-7.1/series index 77dd8210d9..c11342a745 100644 --- a/queue-7.1/series +++ b/queue-7.1/series @@ -622,7 +622,6 @@ mm-huge_memory-set-pg_has_hwpoisoned-only-after-new-folio-head-is-established.pa sctp-don-t-free-the-asconf-s-own-transport-in-del-ip-processing.patch sctp-avoid-auth_enable-sysctl-uaf-during-netns-teardown.patch sctp-close-udp-tunnel-sockets-during-netns-teardown.patch -ceph-add-owner-capability-checks-for-ceph_ioc_set_layout.patch ceph-fix-pre-auth-out-of-bounds-read-on-snaptrace-in-ceph_handle_caps.patch ceph-fix-refcount-leak-in-ceph_readdir.patch ceph-fix-writeback_count-leak-in-write_folio_nounlock.patch