From: Christoph Hellwig <hch@lst.de> mainline inclusion from mainline-v5.6-rc4 commit 3d8f2821502d0b60bac2789d0bea951fda61de0c category: bugfix bugzilla: 185881 CVE: CVE-2021-4037 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... ------------------------------------------------- Instead of only synchronizing the uid/gid values in xfs_setup_inode, ensure that they always match to prepare for removing the icdinode fields. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Guo Xuenan <guoxuenan@huawei.com> Reviewed-by: Zhang Yi <yi.zhang@huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng@huawei.com> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> --- fs/xfs/libxfs/xfs_inode_buf.c | 2 ++ fs/xfs/xfs_icache.c | 4 ++++ fs/xfs/xfs_inode.c | 8 ++++++-- fs/xfs/xfs_iops.c | 3 --- 4 files changed, 12 insertions(+), 5 deletions(-) diff --git a/fs/xfs/libxfs/xfs_inode_buf.c b/fs/xfs/libxfs/xfs_inode_buf.c index 82c4374acb4c6..ed58741e09ea8 100644 --- a/fs/xfs/libxfs/xfs_inode_buf.c +++ b/fs/xfs/libxfs/xfs_inode_buf.c @@ -225,7 +225,9 @@ xfs_inode_from_disk( to->di_format = from->di_format; to->di_uid = be32_to_cpu(from->di_uid); + inode->i_uid = xfs_uid_to_kuid(to->di_uid); to->di_gid = be32_to_cpu(from->di_gid); + inode->i_gid = xfs_gid_to_kgid(to->di_gid); to->di_flushiter = be16_to_cpu(from->di_flushiter); /* diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c index 56e9043bddc71..ceee27b703842 100644 --- a/fs/xfs/xfs_icache.c +++ b/fs/xfs/xfs_icache.c @@ -286,6 +286,8 @@ xfs_reinit_inode( uint64_t version = inode_peek_iversion(inode); umode_t mode = inode->i_mode; dev_t dev = inode->i_rdev; + kuid_t uid = inode->i_uid; + kgid_t gid = inode->i_gid; error = inode_init_always(mp->m_super, inode); @@ -294,6 +296,8 @@ xfs_reinit_inode( inode_set_iversion_queried(inode, version); inode->i_mode = mode; inode->i_rdev = dev; + inode->i_uid = uid; + inode->i_gid = gid; return error; } diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c index c3226c48079da..70d5f0e2aa129 100644 --- a/fs/xfs/xfs_inode.c +++ b/fs/xfs/xfs_inode.c @@ -812,15 +812,19 @@ xfs_ialloc( inode->i_mode = mode; set_nlink(inode, nlink); - ip->i_d.di_uid = xfs_kuid_to_uid(current_fsuid()); - ip->i_d.di_gid = xfs_kgid_to_gid(current_fsgid()); + inode->i_uid = current_fsuid(); + ip->i_d.di_uid = xfs_kuid_to_uid(inode->i_uid); inode->i_rdev = rdev; xfs_set_projid(ip, prid); if (pip && XFS_INHERIT_GID(pip)) { + inode->i_gid = VFS_I(pip)->i_gid; ip->i_d.di_gid = pip->i_d.di_gid; if ((VFS_I(pip)->i_mode & S_ISGID) && S_ISDIR(mode)) inode->i_mode |= S_ISGID; + } else { + inode->i_gid = current_fsgid(); + ip->i_d.di_gid = xfs_kgid_to_gid(inode->i_gid); } /* diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c index 0ac63cafb32a1..2c9d2d2f92983 100644 --- a/fs/xfs/xfs_iops.c +++ b/fs/xfs/xfs_iops.c @@ -1305,9 +1305,6 @@ xfs_setup_inode( /* make the inode look hashed for the writeback code */ inode_fake_hash(inode); - inode->i_uid = xfs_uid_to_kuid(ip->i_d.di_uid); - inode->i_gid = xfs_gid_to_kgid(ip->i_d.di_gid); - i_size_write(inode, ip->i_d.di_size); xfs_diflags_to_iflags(inode, ip); -- 2.25.1