Gh0st
/
linux
mirror of https://github.com/torvalds/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

ovl: refactor ovl_fill_super() 

Split the core into a separate helper in preparation of converting the
caller to the scoped ovl cred guard.

Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-40-b31603935724@kernel.org
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
This commit is contained in:
Christian Brauner 2025-11-17 10:34:11 +01:00
parent db7cfe8783
commit fc95cda673
No known key found for this signature in database
GPG Key ID: 91C61BC06578DCA2
1 changed files with 50 additions and 45 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

95
fs/overlayfs/super.c
View File

@ -1364,53 +1364,35 @@ static void ovl_set_d_op(struct super_block *sb)
set_default_d_op(sb, &ovl_dentry_operations);
}
int ovl_fill_super(struct super_block *sb, struct fs_context *fc)
static int ovl_fill_super_creds(struct fs_context *fc, struct super_block *sb)
{
struct ovl_fs *ofs = sb->s_fs_info;
struct cred *creator_cred = (struct cred *)ofs->creator_cred;
struct ovl_fs_context *ctx = fc->fs_private;
const struct cred *old_cred = NULL;
struct dentry *root_dentry;
struct ovl_entry *oe;
struct ovl_layer *layers;
struct cred *cred;
struct ovl_entry *oe = NULL;
int err;
err = -EIO;
if (WARN_ON(fc->user_ns != current_user_ns()))
goto out_err;
ovl_set_d_op(sb);
err = -ENOMEM;
if (!ofs->creator_cred)
ofs->creator_cred = cred = prepare_creds();
else
cred = (struct cred *)ofs->creator_cred;
if (!cred)
goto out_err;
old_cred = ovl_override_creds(sb);
err = ovl_fs_params_verify(ctx, &ofs->config);
if (err)
goto out_err;
return err;
err = -EINVAL;
if (ctx->nr == 0) {
if (!(fc->sb_flags & SB_SILENT))
pr_err("missing 'lowerdir'\n");
goto out_err;
return err;
}
err = -ENOMEM;
layers = kcalloc(ctx->nr + 1, sizeof(struct ovl_layer), GFP_KERNEL);
if (!layers)
goto out_err;
return err;
ofs->config.lowerdirs = kcalloc(ctx->nr + 1, sizeof(char *), GFP_KERNEL);
if (!ofs->config.lowerdirs) {
kfree(layers);
goto out_err;
return err;
}
ofs->layers = layers;
/*
@ -1443,12 +1425,12 @@ int ovl_fill_super(struct super_block *sb, struct fs_context *fc)
err = -EINVAL;
if (!ofs->config.workdir) {
pr_err("missing 'workdir'\n");
goto out_err;
return err;
}
err = ovl_get_upper(sb, ofs, &layers[0], &ctx->upper);
if (err)
goto out_err;
return err;
upper_sb = ovl_upper_mnt(ofs)->mnt_sb;
if (!ovl_should_sync(ofs)) {
@ -1456,13 +1438,13 @@ int ovl_fill_super(struct super_block *sb, struct fs_context *fc)
if (errseq_check(&upper_sb->s_wb_err, ofs->errseq)) {
err = -EIO;
pr_err("Cannot mount volatile when upperdir has an unseen error. Sync upperdir fs to clear state.\n");
goto out_err;
return err;
}
}
err = ovl_get_workdir(sb, ofs, &ctx->upper, &ctx->work);
if (err)
goto out_err;
return err;
if (!ofs->workdir)
sb->s_flags |= SB_RDONLY;
@ -1473,7 +1455,7 @@ int ovl_fill_super(struct super_block *sb, struct fs_context *fc)
oe = ovl_get_lowerstack(sb, ctx, ofs, layers);
err = PTR_ERR(oe);
if (IS_ERR(oe))
goto out_err;
return err;
/* If the upper fs is nonexistent, we mark overlayfs r/o too */
if (!ovl_upper_mnt(ofs))
@ -1526,7 +1508,7 @@ int ovl_fill_super(struct super_block *sb, struct fs_context *fc)
sb->s_export_op = &ovl_export_fid_operations;
/* Never override disk quota limits or use reserved space */
cap_lower(cred->cap_effective, CAP_SYS_RESOURCE);
cap_lower(creator_cred->cap_effective, CAP_SYS_RESOURCE);
sb->s_magic = OVERLAYFS_SUPER_MAGIC;
sb->s_xattr = ovl_xattr_handlers(ofs);
@ -1544,27 +1526,50 @@ int ovl_fill_super(struct super_block *sb, struct fs_context *fc)
sb->s_iflags |= SB_I_EVM_HMAC_UNSUPPORTED;
err = -ENOMEM;
root_dentry = ovl_get_root(sb, ctx->upper.dentry, oe);
if (!root_dentry)
sb->s_root = ovl_get_root(sb, ctx->upper.dentry, oe);
if (!sb->s_root)
goto out_free_oe;
sb->s_root = root_dentry;
ovl_revert_creds(old_cred);
return 0;
out_free_oe:
ovl_free_entry(oe);
return err;
}
int ovl_fill_super(struct super_block *sb, struct fs_context *fc)
{
struct ovl_fs *ofs = sb->s_fs_info;
const struct cred *old_cred = NULL;
struct cred *cred;
int err;
err = -EIO;
if (WARN_ON(fc->user_ns != current_user_ns()))
goto out_err;
ovl_set_d_op(sb);
err = -ENOMEM;
if (!ofs->creator_cred)
ofs->creator_cred = cred = prepare_creds();
else
cred = (struct cred *)ofs->creator_cred;
if (!cred)
goto out_err;
old_cred = ovl_override_creds(sb);
err = ovl_fill_super_creds(fc, sb);
ovl_revert_creds(old_cred);
out_err:
/*
* Revert creds before calling ovl_free_fs() which will call
* put_cred() and put_cred() requires that the cred's that are
* put are not the caller's creds, i.e., current->cred.
*/
if (old_cred)
ovl_revert_creds(old_cred);
ovl_free_fs(ofs);
sb->s_fs_info = NULL;
if (err) {
ovl_free_fs(ofs);
sb->s_fs_info = NULL;
}
return err;
}