Re: [PATCH] ceph: use the mount idmap for the owner checks in the SET_LAYOUT ioctls

[Ilya Dryomov]

On Mon, Jul 27, 2026 at 3:47 AM Zhan Xusheng <zhanxusheng1024@xxxxxxxxx> wrote:
>
> From: Zhan Xusheng <zhanxusheng@xxxxxxxxxx>
>
> ceph_ioctl_set_layout() and ceph_ioctl_set_layout_policy() call
> inode_owner_or_capable() with &nop_mnt_idmap instead of the idmap of the
> mount the ioctl was issued on.
>
> CephFS supports idmapped mounts (FS_ALLOW_IDMAP), so on such a mount this
> compares the caller's fsuid against the unmapped on-disk owner rather than
> the mapped owner: the actual owner can be wrongly denied with -EACCES and
> an unrelated caller wrongly allowed.  Both functions already have the
> struct file, so use file_mnt_idmap(file) instead.
>
> Fixes: cee38bbf5556 ("ceph: add owner/capability checks for CEPH_IOC_SET_LAYOUT*")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Zhan Xusheng <zhanxusheng@xxxxxxxxxx>
> ---
>  fs/ceph/ioctl.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/fs/ceph/ioctl.c b/fs/ceph/ioctl.c
> index de07f19b0caa..12cb50e0a166 100644
> --- a/fs/ceph/ioctl.c
> +++ b/fs/ceph/ioctl.c
> @@ -72,7 +72,7 @@ static long ceph_ioctl_set_layout(struct file *file, void __user *arg)
>         struct ceph_ioctl_layout nl;
>         int err;
>
> -       if (!inode_owner_or_capable(&nop_mnt_idmap, inode))
> +       if (!inode_owner_or_capable(file_mnt_idmap(file), inode))
>                 return -EACCES;
>
>         if (copy_from_user(&l, arg, sizeof(l)))
> @@ -145,7 +145,7 @@ static long ceph_ioctl_set_layout_policy (struct file *file, void __user *arg)
>         int err;
>         struct ceph_mds_client *mdsc = ceph_sb_to_fs_client(inode->i_sb)->mdsc;
>
> -       if (!inode_owner_or_capable(&nop_mnt_idmap, inode))
> +       if (!inode_owner_or_capable(file_mnt_idmap(file), inode))

Hi Max,

Was there any specific reason you used nop_mnt_idmap for these checks?

Thanks,

                Ilya