vfs: move permission checking into notify_change() for utimes(NULL)

This fixes a bug where the permission was not properly checked in
overlayfs.  The testcase is ltp/utimensat01.

It is also cleaner and safer to do the permission checking in the vfs
helper instead of the caller.

This patch introduces an additional ia_valid flag ATTR_TOUCH (since
touch(1) is the most obvious user of utimes(NULL)) that is passed into
notify_change whenever the conditions for this special permission checking
mode are met.

Reported-by: Aihua Zhang <zhangaihua1@huawei.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Tested-by: Aihua Zhang <zhangaihua1@huawei.com>
Cc: <stable@vger.kernel.org> # v3.18+

1 files changed, 1 insertions, 16 deletions

diff --git a/fs/utimes.c b/fs/utimes.c
index 794f5f5b1fb5..ba54b9e648c9 100644
--- a/fs/utimes.c
+++ b/fs/utimes.c
@@ -87,21 +87,7 @@ static int utimes_common(struct path *path, struct timespec *times)
                  */
                 newattrs.ia_valid |= ATTR_TIMES_SET;
         } else {
-                /*
-                 * If times is NULL (or both times are UTIME_NOW),
-                 * then we need to check permissions, because
-                 * inode_change_ok() won't do it.
-                 */
-                error = -EPERM;
-                if (IS_IMMUTABLE(inode))
-                        goto mnt_drop_write_and_out;
-
-                error = -EACCES;
-                if (!inode_owner_or_capable(inode)) {
-                        error = inode_permission(inode, MAY_WRITE);
-                        if (error)
-                                goto mnt_drop_write_and_out;
-                }
+                newattrs.ia_valid |= ATTR_TOUCH;
         }
 retry_deleg:
         inode_lock(inode);
@@ -113,7 +99,6 @@ retry_deleg:
                         goto retry_deleg;
         }
 
-mnt_drop_write_and_out:
         mnt_drop_write(path->mnt);
 out:
         return error;