Commit f777d111 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'vfs-6.17-rc6.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs 

Pull vfs fixes from Christian Brauner:
 "fuse:

   - Prevent opening of non-regular backing files.

     Fuse doesn't support non-regular files anyway.

   - Check whether copy_file_range() returns a larger size than
     requested.

   - Prevent overflow in copy_file_range() as fuse currently only
     supports 32-bit sized copies.

   - Cache the blocksize value if the server returned a new value as
     inode->i_blkbits isn't modified directly anymore.

   - Fix i_blkbits handling for iomap partial writes.

     By default i_blkbits is set to PAGE_SIZE which causes iomap to mark
     the whole folio as uptodate even on a partial write. But fuseblk
     filesystems support choosing a blocksize smaller than PAGE_SIZE
     risking data corruption. Simply enforce PAGE_SIZE as blocksize for
     fuseblk's internal inode for now.

   - Prevent out-of-bounds acces in fuse_dev_write() when the number of
     bytes to be retrieved is truncated to the fc->max_pages limit.

  virtiofs:

   - Fix page faults for DAX page addresses.

  Misc:

   - Tighten file handle decoding from userns.

     Check that the decoded dentry itself has a valid idmapping in the
     user namespace.

   - Fix mount-notify selftests.

   - Fix some indentation errors.

   - Add an FMODE_ flag to indicate IOCB_HAS_METADATA availability.

     This will be moved to an FOP_* flag with a bit more rework needed
     for that to happen not suitable for a fix.

   - Don't silently ignore metadata for sync read/write.

   - Don't pointlessly log warning when reading coredump sysctls"

* tag 'vfs-6.17-rc6.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  fuse: virtio_fs: fix page fault for DAX page address
  selftests/fs/mount-notify: Fix compilation failure.
  fhandle: use more consistent rules for decoding file handle from userns
  fuse: Block access to folio overlimit
  fuse: fix fuseblk i_blkbits for iomap partial writes
  fuse: reflect cached blocksize if blocksize was changed
  fuse: prevent overflow in copy_file_range return value
  fuse: check if copy_file_range() returns larger than requested size
  fuse: do not allow mapping a non-regular backing file
  coredump: don't pointlessly check and spew warnings
  fs: fix indentation style
  block: don't silently ignore metadata for sync read/write
  fs: add a FMODE_ flag to indicate IOCB_HAS_METADATA availability
  Please enter a commit message to explain why this merge is necessary,
  especially if it merges an updated upstream into a topic branch.
parents 76eeb9b8 e1bf212d

block/fops.c

+8 −5
Original line number Diff line number Diff line
@@ -7,6 +7,7 @@ 
#include <linux/init.h>

#include <linux/mm.h>

#include <linux/blkdev.h>

#include <linux/blk-integrity.h>

#include <linux/buffer_head.h>

#include <linux/mpage.h>

#include <linux/uio.h>
@@ -54,7 +55,6 @@ static ssize_t __blkdev_direct_IO_simple(struct kiocb *iocb, 
	struct bio bio;

	ssize_t ret;



	WARN_ON_ONCE(iocb->ki_flags & IOCB_HAS_METADATA);

	if (nr_pages <= DIO_INLINE_BIO_VECS)

		vecs = inline_vecs;

	else {
@@ -131,7 +131,7 @@ static void blkdev_bio_end_io(struct bio *bio) 
	if (bio->bi_status && !dio->bio.bi_status)

		dio->bio.bi_status = bio->bi_status;



	if (!is_sync && (dio->iocb->ki_flags & IOCB_HAS_METADATA))

	if (bio_integrity(bio))

		bio_integrity_unmap_user(bio);



	if (atomic_dec_and_test(&dio->ref)) {
@@ -233,7 +233,7 @@ static ssize_t __blkdev_direct_IO(struct kiocb *iocb, struct iov_iter *iter, 
			}

			bio->bi_opf |= REQ_NOWAIT;

		}

		if (!is_sync && (iocb->ki_flags & IOCB_HAS_METADATA)) {

		if (iocb->ki_flags & IOCB_HAS_METADATA) {

			ret = bio_integrity_map_iter(bio, iocb->private);

			if (unlikely(ret))

				goto fail;
@@ -301,7 +301,7 @@ static void blkdev_bio_end_io_async(struct bio *bio) 
		ret = blk_status_to_errno(bio->bi_status);

	}



	if (iocb->ki_flags & IOCB_HAS_METADATA)

	if (bio_integrity(bio))

		bio_integrity_unmap_user(bio);



	iocb->ki_complete(iocb, ret);
@@ -422,7 +422,8 @@ static ssize_t blkdev_direct_IO(struct kiocb *iocb, struct iov_iter *iter) 
	}



	nr_pages = bio_iov_vecs_to_alloc(iter, BIO_MAX_VECS + 1);

	if (likely(nr_pages <= BIO_MAX_VECS)) {

	if (likely(nr_pages <= BIO_MAX_VECS &&

		   !(iocb->ki_flags & IOCB_HAS_METADATA))) {

		if (is_sync_kiocb(iocb))

			return __blkdev_direct_IO_simple(iocb, iter, bdev,

							nr_pages);
@@ -687,6 +688,8 @@ static int blkdev_open(struct inode *inode, struct file *filp) 


	if (bdev_can_atomic_write(bdev))

		filp->f_mode |= FMODE_CAN_ATOMIC_WRITE;

	if (blk_get_integrity(bdev->bd_disk))

		filp->f_mode |= FMODE_HAS_METADATA;



	ret = bdev_open(bdev, mode, filp->private_data, NULL, filp);

	if (ret)

fs/coredump.c

+4 −0
Original line number Diff line number Diff line
@@ -1466,11 +1466,15 @@ static int proc_dostring_coredump(const struct ctl_table *table, int write, 
	ssize_t retval;

	char old_core_pattern[CORENAME_MAX_SIZE];



	if (write)

		return proc_dostring(table, write, buffer, lenp, ppos);



	retval = strscpy(old_core_pattern, core_pattern, CORENAME_MAX_SIZE);



	error = proc_dostring(table, write, buffer, lenp, ppos);

	if (error)

		return error;



	if (!check_coredump_socket()) {

		strscpy(core_pattern, old_core_pattern, retval + 1);

		return -EINVAL;

fs/exec.c

+1 −1
Original line number Diff line number Diff line
@@ -2048,7 +2048,7 @@ static int proc_dointvec_minmax_coredump(const struct ctl_table *table, int writ 
{

	int error = proc_dointvec_minmax(table, write, buffer, lenp, ppos);



	if (!error)

	if (!error && !write)

		validate_coredump_safety();

	return error;

}

fs/fhandle.c

+8 −0
Original line number Diff line number Diff line
@@ -207,6 +207,14 @@ static int vfs_dentry_acceptable(void *context, struct dentry *dentry) 
	if (!ctx->flags)

		return 1;



	/*

	 * Verify that the decoded dentry itself has a valid id mapping.

	 * In case the decoded dentry is the mountfd root itself, this

	 * verifies that the mountfd inode itself has a valid id mapping.

	 */

	if (!privileged_wrt_inode_uidgid(user_ns, idmap, d_inode(dentry)))

		return 0;



	/*

	 * It's racy as we're not taking rename_lock but we're able to ignore

	 * permissions and we just need an approximation whether we were able

fs/fuse/dev.c

+1 −1
Original line number Diff line number Diff line
@@ -1893,7 +1893,7 @@ static int fuse_retrieve(struct fuse_mount *fm, struct inode *inode, 


	index = outarg->offset >> PAGE_SHIFT;



	while (num) {

	while (num && ap->num_folios < num_pages) {

		struct folio *folio;

		unsigned int folio_offset;

		unsigned int nr_bytes;