From: Zhan Xusheng Date: Mon, 27 Jul 2026 01:47:44 +0000 (+0800) Subject: ceph: use the mount idmap for the owner checks in the SET_LAYOUT ioctls X-Git-Tag: v7.2~21^2 X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=91880e4a7fac45bc407771bc57bbaf4f37e9b4c3;p=thirdparty%2Fkernel%2Fstable.git ceph: use the mount idmap for the owner checks in the SET_LAYOUT ioctls ceph_ioctl_set_layout() and ceph_ioctl_set_layout_policy() call inode_owner_or_capable() with &nop_mnt_idmap instead of the idmap of the mount the ioctl was issued on. CephFS supports idmapped mounts (FS_ALLOW_IDMAP), so on such a mount this compares the caller's fsuid against the unmapped on-disk owner rather than the mapped owner: the actual owner can be wrongly denied with -EACCES and an unrelated caller wrongly allowed. Both functions already have the struct file, so use file_mnt_idmap(file) instead. Cc: stable@vger.kernel.org Fixes: cee38bbf5556 ("ceph: add owner/capability checks for CEPH_IOC_SET_LAYOUT*") Signed-off-by: Zhan Xusheng Reviewed-by: Xiubo Li Reviewed-by: Alex Markuze Signed-off-by: Ilya Dryomov --- diff --git a/fs/ceph/ioctl.c b/fs/ceph/ioctl.c index de07f19b0caa..12cb50e0a166 100644 --- a/fs/ceph/ioctl.c +++ b/fs/ceph/ioctl.c @@ -72,7 +72,7 @@ static long ceph_ioctl_set_layout(struct file *file, void __user *arg) struct ceph_ioctl_layout nl; int err; - if (!inode_owner_or_capable(&nop_mnt_idmap, inode)) + if (!inode_owner_or_capable(file_mnt_idmap(file), inode)) return -EACCES; if (copy_from_user(&l, arg, sizeof(l))) @@ -145,7 +145,7 @@ static long ceph_ioctl_set_layout_policy (struct file *file, void __user *arg) int err; struct ceph_mds_client *mdsc = ceph_sb_to_fs_client(inode->i_sb)->mdsc; - if (!inode_owner_or_capable(&nop_mnt_idmap, inode)) + if (!inode_owner_or_capable(file_mnt_idmap(file), inode)) return -EACCES; /* copy and validate */