On Sun, Aug 2, 2026, at 17:51, Junrui Luo via B4 Relay wrote: > From: Junrui Luo <[email protected]> > > spufs_setattr() applies the caller's attributes with setattr_copy() but > never calls setattr_prepare(). notify_change() leaves that to the > filesystem: it runs only may_setattr(), while inode_owner_or_capable() > and the CAP_CHOWN test live inside setattr_prepare(). setattr_copy() > performs no checking of its own. > > The handler is installed for every regular spufs file, so mode and > ownership of another user's context files can be changed without the > usual authorization. > > Call setattr_prepare() before setattr_copy(). The existing ATTR_SIZE > test stays ahead of it so that resizing a spufs file keeps returning > -EINVAL. &nop_mnt_idmap matches the adjacent setattr_copy() call. > > Fixes: 67207b9664a8 ("[PATCH] spufs: The SPU file system, base") > Reported-by: Yuhao Jiang <[email protected]> > Cc: [email protected] > Signed-off-by: Junrui Luo <[email protected]>
Reviewed-by: Arnd Bergmann <[email protected]>
