[Devel] [PATCH RHEL7 COMMIT] ms/ovl: fix permission checking for setattr

[Konstantin Khorenko]

The commit is pushed to "branch-rh7-3.10.0-229.7.2.vz7.9.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-229.7.2.vz7.9.20
------>
commit b51ecb573ac11fc5ed86c210c1731607199c9652
Author: Cyrill Gorcunov <gorcunov at virtuozzo.com>
Date:   Thu Jan 14 15:57:30 2016 +0400

    ms/ovl: fix permission checking for setattr
    
    This fixes CVE-2015-8660.
    https://access.redhat.com/security/cve/cve-2015-8660
    
    ms commit: acff81ec2c79492b180fade3c2894425cd35a545
    
    From: Miklos Szeredi <miklos at szeredi.hu>
    
    [Al Viro] The bug is in being too enthusiastic about optimizing ->setattr()
    away - instead of "copy verbatim with metadata" + "chmod/chown/utimes"
    (with the former being always safe and the latter failing in case of
    insufficient permissions) it tries to combine these two.  Note that copyup
    itself will have to do ->setattr() anyway; _that_ is where the elevated
    capabilities are right.  Having these two ->setattr() (one to set verbatim
    copy of metadata, another to do what overlayfs ->setattr() had been asked
    to do in the first place) combined is where it breaks.
    
    Signed-off-by: Miklos Szeredi <miklos at szeredi.hu>
    Cc: <stable at vger.kernel.org>
    Signed-off-by: Al Viro <viro at zeniv.linux.org.uk>
    Signed-off-by: Cyrill Gorcunov <gorcunov at openvz.org>
---
 fs/overlayfs/inode.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
index 9ad8de5..70db25a 100644
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -49,13 +49,13 @@ int ovl_setattr(struct dentry *dentry, struct iattr *attr)
 	if (err)
 		goto out;
 
-	upperdentry = ovl_dentry_upper(dentry);
-	if (upperdentry) {
+	err = ovl_copy_up(dentry);
+	if (!err) {
+		upperdentry = ovl_dentry_upper(dentry);
+
 		mutex_lock(&upperdentry->d_inode->i_mutex);
 		err = notify_change(upperdentry, attr, NULL);
 		mutex_unlock(&upperdentry->d_inode->i_mutex);
-	} else {
-		err = ovl_copy_up_last(dentry, attr, false);
 	}
 	ovl_drop_write(dentry);
 out: