[PATCH] filelock: prevent FL_LEASE and FL_DELEG flavor confusion in generic_add_lease()

[Hui Peng]

generic_add_lease() searches ctx->flc_lease for an existing entry
matching (flc_file == filp && flc_owner == lease->c.flc_owner) in order
to modify an existing lease in place via lease_modify(). However, it
does not verify that the existing entry's flavor (FL_LEASE vs FL_DELEG)
matches the newly requested lease's flavor in flc_flags.

Since both F_SETLEASE and F_SETDELEG pass filp as flc_owner from
userland (fcntl_setlease() and fcntl_setdeleg()), calling F_SETDELEG on
a file descriptor that already holds an FL_LEASE modifies flc_type in
place and returns 0 without setting FL_DELEG in flc_flags. Conversely,
calling F_SETLEASE on a file descriptor that holds an active FL_DELEG
modifies the delegation in place without holding inode_lock() (which
vfs_setlease() only acquires when is_deleg is true).

Reject cross-flavor modifications in generic_add_lease() when the
existing entry on ctx->flc_lease has a different (FL_LEASE | FL_DELEG)
flag mask from the requested lease.

Fixes: 1602bad16d7d ("vfs: expose delegation support to userland")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@xxxxxxxxx>

---
 fs/locks.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/locks.c b/fs/locks.c
index 6e4ff7fcec05..15d73f8f48cd 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -1938,6 +1938,9 @@ generic_add_lease(struct file *filp, int arg, struct file_lease **flp, void **pr
 	list_for_each_entry(fl, &ctx->flc_lease, c.flc_list) {
 		if (fl->c.flc_file == filp &&
 		    fl->c.flc_owner == lease->c.flc_owner) {
+			if ((fl->c.flc_flags & (FL_LEASE | FL_DELEG)) !=
+			    (lease->c.flc_flags & (FL_LEASE | FL_DELEG)))
+				goto out;
 			my_fl = fl;
 			continue;
 		}
-- 
2.55.0.1082.g2b9226bbc0-goog