superrob1500
/
mirror-linux
mirror of https://github.com/torvalds/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

9p: fix access mode flags being ORed instead of replaced 

Since commit 1f3e4142c0 ("9p: convert to the new mount API"),
v9fs_apply_options() applies parsed mount flags with |= onto flags
already set by v9fs_session_init(). For 9P2000.L, session_init sets
V9FS_ACCESS_CLIENT as the default, so when the user mounts with
"access=user", both bits end up set. Access mode checks compare
against exact values, so having both bits set matches neither mode.

This causes v9fs_fid_lookup() to fall through to the default switch
case, using INVALID_UID (nobody/65534) instead of current_fsuid()
for all fid lookups. Root is then unable to chown or perform other
privileged operations.

Fix by clearing the access mask before applying the user's choice.

Fixes: 1f3e4142c0 ("9p: convert to the new mount API")
Signed-off-by: Pierre Barre <pierre@barre.sh>
Reviewed-by: Christian Schoenebeck <linux_oss@crudebyte.com>
Message-ID: <0ddc72da-d196-4f01-8755-0086f670e779@app.fastmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
master
Pierre Barre 2026-04-02 12:03:12 +02:00 committed by Dominique Martinet
parent 0fd76f1be2
commit da2346a48a
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
fs/9p/v9fs.c
View File

@ -413,7 +413,11 @@ static void v9fs_apply_options(struct v9fs_session_info *v9ses,
/*
* Note that we must |= flags here as session_init already
* set basic flags. This adds in flags from parsed options.
* Default access flags must be cleared if session options
* changes them to avoid mangling the setting.
*/
if (ctx->session_opts.flags & V9FS_ACCESS_MASK)
v9ses->flags &= ~V9FS_ACCESS_MASK;
v9ses->flags |= ctx->session_opts.flags;
#ifdef CONFIG_9P_FSCACHE
v9ses->cachetag = ctx->session_opts.cachetag;