[GIT PULL] vfs fixes

[Christian Brauner]

/* Summary */
This contains two fixes for this merge window:

VFS:

- I noticed that it is possible for a privileged user to mount most filesystems
  with a non-initial user namespace in sb->s_user_ns. When fsopen() is called
  in a non-init namespace the caller's namespace is recorded in
  fs_context->user_ns. If the returned file descriptor is then passed to a
  process privileged in init_user_ns, that process can call
  fsconfig(fd_fs, FSCONFIG_CMD_CREATE*), creating a new superblock with
  sb->s_user_ns set to the namespace of the process which called fsopen().

  This is problematic as only filesystems that raise FS_USERNS_MOUNT are known
  to be able to support a non-initial s_user_ns. Others may suffer security
  issues, on-disk corruption or outright crash the kernel. Prevent that by
  restricting such delegation to filesystems that allow FS_USERNS_MOUNT.

  Note, that this delegation requires a privileged process to actually create
  the superblock so either the privileged process is cooperaing or someone must
  have tricked a privileged process into operating on a fscontext file
  descriptor whose origin it doesn't know (a stupid idea).

  The bug dates back to about 5 years afaict.

misc:

- Fix hostfs parsing when the mount request comes in via the legacy mount api.
  In the legacy mount api hostfs allows to specify the host directory mount
  without any key. Restore that behavior.

/* Testing */
clang: Debian clang version 16.0.6 (27)
gcc: (Debian 13.2.0-25) 13.2.0

/* Conflicts */
No known conflicts.

The following changes since commit c33ffdb70cc6df4105160f991288e7d2567d7ffa:

  Merge tag 'phy-for-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy (2024-07-24 13:11:28 -0700)

are available in the Git repository at:

  git@xxxxxxxxxxxxxxxxxxx:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-6.11-rc1.fixes.3

for you to fetch changes up to ef9ca17ca458ac7253ae71b552e601e49311fc48:

  hostfs: fix the host directory parse when mounting. (2024-07-27 09:56:33 +0200)

Please consider pulling these changes from the signed vfs-6.11-rc1.fixes.3 tag.

Thanks!
Christian

----------------------------------------------------------------
vfs-6.11-rc1.fixes.3

----------------------------------------------------------------
Hongbo Li (1):
      hostfs: fix the host directory parse when mounting.

Seth Forshee (DigitalOcean) (1):
      fs: don't allow non-init s_user_ns for filesystems without FS_USERNS_MOUNT

 fs/hostfs/hostfs_kern.c | 65 +++++++++++++++++++++++++++++++++++++++++--------
 fs/super.c              | 11 +++++++++
 2 files changed, 66 insertions(+), 10 deletions(-)