Commit cee38bbf5556 for kernel

commit cee38bbf5556a8e0a232ccae41649580827d7806
Author: Max Kellermann <max.kellermann@ionos.com>
Date:   Tue Jul 21 08:20:46 2026 +0200

    ceph: add owner/capability checks for CEPH_IOC_SET_LAYOUT*

    These permission checks were already missing in the initial
    impementation of these ioctls.  This Ceph allows any user who owns a
    file descriptor to manipulate the layout of any file, even if they
    don't have write permissions.

    It might be a good idea to guard other ioctls with permission checks
    as well or even disallow regular users (even if they own the file) to
    manipulate layout settings completely, as this may be abused to DoS
    the Ceph servers, but right now, I find it most urgent to have setter
    checks at all.

    Cc: stable@vger.kernel.org
    Fixes: 8f4e91dee2a2 ("ceph: ioctls")
    Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
    Reviewed-by: Xiubo Li <xiubo.li@clyso.com>
    Signed-off-by: Ilya Dryomov <idryomov@gmail.com>

diff --git a/fs/ceph/ioctl.c b/fs/ceph/ioctl.c
index 15cde055f3da..de07f19b0caa 100644
--- a/fs/ceph/ioctl.c
+++ b/fs/ceph/ioctl.c
@@ -72,6 +72,9 @@ static long ceph_ioctl_set_layout(struct file *file, void __user *arg)
 	struct ceph_ioctl_layout nl;
 	int err;

+	if (!inode_owner_or_capable(&nop_mnt_idmap, inode))
+		return -EACCES;
+
 	if (copy_from_user(&l, arg, sizeof(l)))
 		return -EFAULT;

@@ -142,6 +145,9 @@ static long ceph_ioctl_set_layout_policy (struct file *file, void __user *arg)
 	int err;
 	struct ceph_mds_client *mdsc = ceph_sb_to_fs_client(inode->i_sb)->mdsc;

+	if (!inode_owner_or_capable(&nop_mnt_idmap, inode))
+		return -EACCES;
+
 	/* copy and validate */
 	if (copy_from_user(&l, arg, sizeof(l)))
 		return -EFAULT;