[PATCH 1/2] ovl: fix mount setup failing when override_creds drops CAP_SYS_ADMIN

[Disha Goel]

When a process drops CAP_SYS_ADMIN and calls fsconfig(FSCONFIG_SET_FLAG,
"override_creds"), overlayfs saves those restricted credentials in
ofs->creator_cred.  ovl_fill_super() then wrapped the entire mount setup
in with_ovl_creds(), switching to those restricted credentials for the
duration.

Mount setup calls clone_private_mount(), which checks CAP_SYS_ADMIN
against current credentials.  With restricted credentials active, this
check fails with -EPERM and the mount fails even though the calling
process is fully privileged.

Mount setup is a one-time privileged operation and must run under the
caller's credentials.  with_ovl_creds() belongs only in post-mount I/O
paths.  Remove it from ovl_fill_super().

Fixes: 539a0879de47 ("ovl: allow to specify override credentials")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Disha Goel <disgoel@xxxxxxxxxxxxx>
---
 fs/overlayfs/super.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index bd0a3f9039d2..29f9489b8242 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -1557,8 +1557,12 @@ int ovl_fill_super(struct super_block *sb, struct fs_context *fc)
 			goto out_err;
 	}
 
-	with_ovl_creds(sb)
-		err = ovl_fill_super_creds(fc, sb);
+	/*
+	 * Mount setup must run under the caller's credentials, not
+	 * creator_cred: clone_private_mount() requires CAP_SYS_ADMIN,
+	 * which override_creds may have dropped.
+	 */
+	err = ovl_fill_super_creds(fc, sb);
 
 out_err:
 	if (err) {
-- 
2.45.1