diff options
| author | Bob Peterson <rpeterso@redhat.com> | 2020-05-05 11:53:21 -0500 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-06-03 08:19:28 +0200 |
| commit | a359696dfd93ed81a1ae23b63f329442953c7578 (patch) | |
| tree | f947b1ea486574f5cc453f8cf5d706a06d74ffba /fs/gfs2 | |
| parent | 427c63e10374dc588f8802faaf56cd39f09a53d5 (diff) | |
| download | linux-stable-a359696dfd93ed81a1ae23b63f329442953c7578.tar.gz linux-stable-a359696dfd93ed81a1ae23b63f329442953c7578.tar.bz2 linux-stable-a359696dfd93ed81a1ae23b63f329442953c7578.zip | |
gfs2: move privileged user check to gfs2_quota_lock_check
[ Upstream commit 4ed0c30811cb4d30ef89850b787a53a84d5d2bcb ]
Before this patch, function gfs2_quota_lock checked if it was called
from a privileged user, and if so, it bypassed the quota check:
superuser can operate outside the quotas.
That's the wrong place for the check because the lock/unlock functions
are separate from the lock_check function, and you can do lock and
unlock without actually checking the quotas.
This patch moves the check to gfs2_quota_lock_check.
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'fs/gfs2')
| -rw-r--r-- | fs/gfs2/quota.c | 3 | ||||
| -rw-r--r-- | fs/gfs2/quota.h | 3 |
2 files changed, 3 insertions, 3 deletions
diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c index 0efae7a0ee80..dd0f9bc13164 100644 --- a/fs/gfs2/quota.c +++ b/fs/gfs2/quota.c @@ -1043,8 +1043,7 @@ int gfs2_quota_lock(struct gfs2_inode *ip, kuid_t uid, kgid_t gid) u32 x; int error = 0; - if (capable(CAP_SYS_RESOURCE) || - sdp->sd_args.ar_quota != GFS2_QUOTA_ON) + if (sdp->sd_args.ar_quota != GFS2_QUOTA_ON) return 0; error = gfs2_quota_hold(ip, uid, gid); diff --git a/fs/gfs2/quota.h b/fs/gfs2/quota.h index 836f29480be6..e3a6e2404d11 100644 --- a/fs/gfs2/quota.h +++ b/fs/gfs2/quota.h @@ -47,7 +47,8 @@ static inline int gfs2_quota_lock_check(struct gfs2_inode *ip, int ret; ap->allowed = UINT_MAX; /* Assume we are permitted a whole lot */ - if (sdp->sd_args.ar_quota == GFS2_QUOTA_OFF) + if (capable(CAP_SYS_RESOURCE) || + sdp->sd_args.ar_quota == GFS2_QUOTA_OFF) return 0; ret = gfs2_quota_lock(ip, NO_UID_QUOTA_CHANGE, NO_GID_QUOTA_CHANGE); if (ret) |