From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933980AbdA0LTT (ORCPT ); Fri, 27 Jan 2017 06:19:19 -0500 Received: from mx2.suse.de ([195.135.220.15]:35799 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933918AbdA0LNT (ORCPT ); Fri, 27 Jan 2017 06:13:19 -0500 X-Amavis-Alert: BAD HEADER SECTION, Duplicate header field: "References" From: Jiri Slaby To: stable@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Gu Zheng , Al Viro , Jan Kara , Jiri Slaby Subject: [PATCH 3.12 235/235] tmpfs: clear S_ISGID when setting posix ACLs Date: Fri, 27 Jan 2017 11:56:08 +0100 Message-Id: <2cfd5bfd048cd9c7deb88fd4f618061d8beb6427.1485514374.git.jslaby@suse.cz> X-Mailer: git-send-email 2.11.0 In-Reply-To: <5b46dc789ca2be4046e4e40a131858d386cac741.1485514374.git.jslaby@suse.cz> References: <5b46dc789ca2be4046e4e40a131858d386cac741.1485514374.git.jslaby@suse.cz> In-Reply-To: References: Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Gu Zheng 3.12-stable review patch. If anyone has any objections, please let me know. =============== commit 497de07d89c1410d76a15bec2bb41f24a2a89f31 upstream. This change was missed the tmpfs modification in In CVE-2016-7097 commit 073931017b49 ("posix_acl: Clear SGID bit when setting file permissions") It can test by xfstest generic/375, which failed to clear setgid bit in the following test case on tmpfs: touch $testfile chown 100:100 $testfile chmod 2755 $testfile _runas -u 100 -g 101 -- setfacl -m u::rwx,g::rwx,o::rwx $testfile Signed-off-by: Gu Zheng Signed-off-by: Al Viro Signed-off-by: Jan Kara Signed-off-by: Jiri Slaby --- fs/generic_acl.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/fs/generic_acl.c b/fs/generic_acl.c index b3f3676796d3..7855cfb938f6 100644 --- a/fs/generic_acl.c +++ b/fs/generic_acl.c @@ -82,19 +82,21 @@ generic_acl_set(struct dentry *dentry, const char *name, const void *value, return PTR_ERR(acl); } if (acl) { + struct posix_acl *old_acl; + error = posix_acl_valid(acl); if (error) goto failed; switch (type) { case ACL_TYPE_ACCESS: - error = posix_acl_equiv_mode(acl, &inode->i_mode); + old_acl = acl; + error = posix_acl_update_mode(inode, &inode->i_mode, + &acl); if (error < 0) goto failed; + if (!acl) + posix_acl_release(old_acl); inode->i_ctime = CURRENT_TIME; - if (error == 0) { - posix_acl_release(acl); - acl = NULL; - } break; case ACL_TYPE_DEFAULT: if (!S_ISDIR(inode->i_mode)) { -- 2.11.0