[PATCH] incfs: Add check for ATTR_KILL_SUID and ATTR_MODE in incfs_setattr

[Tadeusz Struk]

#syz test: https://android.googlesource.com/kernel/common android12-5.10-lts

diff --git a/fs/incfs/vfs.c b/fs/incfs/vfs.c
index 776640451f6f..b46e11963c72 100644
--- a/fs/incfs/vfs.c
+++ b/fs/incfs/vfs.c
@@ -1600,6 +1600,10 @@ static int incfs_setattr(struct dentry *dentry, struct iattr *ia)

backing_inode = d_inode(backing_dentry);

+ if ((ia->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) &&
+ (ia->ia_valid & ATTR_MODE))
+ return -EINVAL;
+
/* incfs files are readonly, but the backing files must be writeable */
if (S_ISREG(backing_inode->i_mode)) {
if ((ia->ia_valid & ATTR_MODE) && (ia->ia_mode & 0222))
--
2.37.3

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+e9053c...@syzkaller.appspotmail.com

Tested on:

commit: 59390358 Merge 5.10.140 into android12-5.10-lts
git tree: android12-5.10-lts
console output: https://syzkaller.appspot.com/x/log.txt?x=134ac15d080000
kernel config: https://syzkaller.appspot.com/x/.config?x=710ac82b1e8d5ed2
dashboard link: https://syzkaller.appspot.com/bug?extid=e9053c4a1d7980b9f981
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=14f28b4f080000

Note: testing is done by a robot and is best-effort only.