Commit 1c8aa833 authored by Amir Goldstein's avatar Amir Goldstein Committed by Christian Brauner
Browse files

fs: move permission hook out of do_iter_write() 



In many of the vfs helpers, the rw_verity_area() checks are called before
taking sb_start_write(), making them "start-write-safe".
do_iter_write() is an exception to this rule.

do_iter_write() has two callers - vfs_iter_write() and vfs_writev().
Move rw_verify_area() and other checks from do_iter_write() out to
its callers to make them "start-write-safe".

Move also the fsnotify_modify() hook to align with similar pattern
used in vfs_write() and other vfs helpers.

This is needed for fanotify "pre content" events.

Suggested-by: default avatarJan Kara <jack@suse.cz>
Reviewed-by: default avatarJosef Bacik <josef@toxicpanda.com>
Signed-off-by: default avatarAmir Goldstein <amir73il@gmail.com>
Link: https://lore.kernel.org/r/20231122122715.2561213-12-amir73il@gmail.com


Reviewed-by: default avatarJan Kara <jack@suse.cz>
Signed-off-by: default avatarAmir Goldstein <amir73il@gmail.com>
Signed-off-by: default avatarChristian Brauner <brauner@kernel.org>
parent 269aed70

fs/read_write.c

+48 −38
Original line number Diff line number Diff line
@@ -838,33 +838,6 @@ ssize_t vfs_iter_read(struct file *file, struct iov_iter *iter, loff_t *ppos, 
}

EXPORT_SYMBOL(vfs_iter_read);



static ssize_t do_iter_write(struct file *file, struct iov_iter *iter,

			     loff_t *pos, rwf_t flags)

{

	size_t tot_len;

	ssize_t ret = 0;



	if (!(file->f_mode & FMODE_WRITE))

		return -EBADF;

	if (!(file->f_mode & FMODE_CAN_WRITE))

		return -EINVAL;



	tot_len = iov_iter_count(iter);

	if (!tot_len)

		return 0;

	ret = rw_verify_area(WRITE, file, pos, tot_len);

	if (ret < 0)

		return ret;



	if (file->f_op->write_iter)

		ret = do_iter_readv_writev(file, iter, pos, WRITE, flags);

	else

		ret = do_loop_readv_writev(file, iter, pos, WRITE, flags);

	if (ret > 0)

		fsnotify_modify(file);

	return ret;

}



ssize_t vfs_iocb_iter_write(struct file *file, struct kiocb *iocb,

			    struct iov_iter *iter)

{
@@ -896,13 +869,28 @@ EXPORT_SYMBOL(vfs_iocb_iter_write); 
ssize_t vfs_iter_write(struct file *file, struct iov_iter *iter, loff_t *ppos,

		       rwf_t flags)

{

	int ret;

	size_t tot_len;

	ssize_t ret;



	if (!(file->f_mode & FMODE_WRITE))

		return -EBADF;

	if (!(file->f_mode & FMODE_CAN_WRITE))

		return -EINVAL;

	if (!file->f_op->write_iter)

		return -EINVAL;



	tot_len = iov_iter_count(iter);

	if (!tot_len)

		return 0;



	ret = rw_verify_area(WRITE, file, ppos, tot_len);

	if (ret < 0)

		return ret;



	file_start_write(file);

	ret = do_iter_write(file, iter, ppos, flags);

	ret = do_iter_readv_writev(file, iter, ppos, WRITE, flags);

	if (ret > 0)

		fsnotify_modify(file);

	file_end_write(file);



	return ret;
@@ -932,15 +920,37 @@ static ssize_t vfs_writev(struct file *file, const struct iovec __user *vec, 
	struct iovec iovstack[UIO_FASTIOV];

	struct iovec *iov = iovstack;

	struct iov_iter iter;

	ssize_t ret;

	size_t tot_len;

	ssize_t ret = 0;



	if (!(file->f_mode & FMODE_WRITE))

		return -EBADF;

	if (!(file->f_mode & FMODE_CAN_WRITE))

		return -EINVAL;



	ret = import_iovec(ITER_SOURCE, vec, vlen, ARRAY_SIZE(iovstack), &iov,

			   &iter);

	if (ret < 0)

		return ret;



	tot_len = iov_iter_count(&iter);

	if (!tot_len)

		goto out;



	ret = rw_verify_area(WRITE, file, pos, tot_len);

	if (ret < 0)

		goto out;



	ret = import_iovec(ITER_SOURCE, vec, vlen, ARRAY_SIZE(iovstack), &iov, &iter);

	if (ret >= 0) {

	file_start_write(file);

		ret = do_iter_write(file, &iter, pos, flags);

	if (file->f_op->write_iter)

		ret = do_iter_readv_writev(file, &iter, pos, WRITE, flags);

	else

		ret = do_loop_readv_writev(file, &iter, pos, WRITE, flags);

	if (ret > 0)

		fsnotify_modify(file);

	file_end_write(file);

out:

	kfree(iov);

	}

	return ret;

}