Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

gfs2: move privileged user check to gfs2_quota_lock_check

Browse source 
[ Upstream commit 4ed0c30811cb4d30ef89850b787a53a84d5d2bcb ]

Before this patch, function gfs2_quota_lock checked if it was called
from a privileged user, and if so, it bypassed the quota check:
superuser can operate outside the quotas.
That's the wrong place for the check because the lock/unlock functions
are separate from the lock_check function, and you can do lock and
unlock without actually checking the quotas.

This patch moves the check to gfs2_quota_lock_check.

Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Bob Peterson 2020-05-05 11:53:21 -05:00 • committed by Greg Kroah-Hartman
parent 427c63e103
commit a359696dfd
2 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
fs/gfs2/quota.c
View file

@ -1043,8 +1043,7 @@ int gfs2_quota_lock(struct gfs2_inode *ip, kuid_t uid, kgid_t gid)
u32 x; u32 x;
int error = 0; int error = 0;
if (capable(CAP_SYS_RESOURCE) || if (sdp->sd_args.ar_quota != GFS2_QUOTA_ON)
sdp->sd_args.ar_quota != GFS2_QUOTA_ON)
return 0; return 0;
error = gfs2_quota_hold(ip, uid, gid); error = gfs2_quota_hold(ip, uid, gid);

3
fs/gfs2/quota.h
View file

@ -47,7 +47,8 @@ static inline int gfs2_quota_lock_check(struct gfs2_inode *ip,
int ret; int ret;
ap->allowed = UINT_MAX; /* Assume we are permitted a whole lot */ ap->allowed = UINT_MAX; /* Assume we are permitted a whole lot */
if (sdp->sd_args.ar_quota == GFS2_QUOTA_OFF) if (capable(CAP_SYS_RESOURCE) ||
sdp->sd_args.ar_quota == GFS2_QUOTA_OFF)
return 0; return 0;
ret = gfs2_quota_lock(ip, NO_UID_QUOTA_CHANGE, NO_GID_QUOTA_CHANGE); ret = gfs2_quota_lock(ip, NO_UID_QUOTA_CHANGE, NO_GID_QUOTA_CHANGE);
if (ret) if (ret)