Commit 267ed02c authored by Johannes Berg's avatar Johannes Berg
Browse files

hostfs: fix dev_t handling 

dev_t is a kernel type and may have different definitions
in kernel and userspace. On 32-bit x86 this currently makes
the stat structure being 4 bytes longer in the user code,
causing stack corruption.

However, this is (potentially) not the only problem, since
dev_t is a different type on user/kernel side, so we don't
know that the major/minor encoding isn't also different.
Decode/encode it instead to address both problems.

Cc: stable@vger.kernel.org
Fixes: 74ce793b ("hostfs: Fix ephemeral inodes")
Link: https://patch.msgid.link/20240702092440.acc960585dd5.Id0767e12f562a69c6cd3c3262dc3d765db350cf6@changeid


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 53585f9e

fs/hostfs/hostfs.h

+4 −3
Original line number Diff line number Diff line
@@ -63,9 +63,10 @@ struct hostfs_stat { 
	struct hostfs_timespec atime, mtime, ctime;

	unsigned int blksize;

	unsigned long long blocks;

	struct {

		unsigned int maj;

		unsigned int min;

	dev_t dev;

	} rdev, dev;

};



extern int stat_file(const char *path, struct hostfs_stat *p, int fd);

fs/hostfs/hostfs_kern.c

+6 −4
Original line number Diff line number Diff line
@@ -530,10 +530,11 @@ static int hostfs_inode_update(struct inode *ino, const struct hostfs_stat *st) 
static int hostfs_inode_set(struct inode *ino, void *data)

{

	struct hostfs_stat *st = data;

	dev_t rdev;

	dev_t dev, rdev;



	/* Reencode maj and min with the kernel encoding.*/

	rdev = MKDEV(st->maj, st->min);

	rdev = MKDEV(st->rdev.maj, st->rdev.min);

	dev = MKDEV(st->dev.maj, st->dev.min);



	switch (st->mode & S_IFMT) {

	case S_IFLNK:
@@ -559,7 +560,7 @@ static int hostfs_inode_set(struct inode *ino, void *data) 
		return -EIO;

	}



	HOSTFS_I(ino)->dev = st->dev;

	HOSTFS_I(ino)->dev = dev;

	ino->i_ino = st->ino;

	ino->i_mode = st->mode;

	return hostfs_inode_update(ino, st);
@@ -568,8 +569,9 @@ static int hostfs_inode_set(struct inode *ino, void *data) 
static int hostfs_inode_test(struct inode *inode, void *data)

{

	const struct hostfs_stat *st = data;

	dev_t dev = MKDEV(st->dev.maj, st->dev.min);



	return inode->i_ino == st->ino && HOSTFS_I(inode)->dev == st->dev;

	return inode->i_ino == st->ino && HOSTFS_I(inode)->dev == dev;

}



static struct inode *hostfs_iget(struct super_block *sb, char *name)

fs/hostfs/hostfs_user.c

+4 −3
Original line number Diff line number Diff line
@@ -34,9 +34,10 @@ static void stat64_to_hostfs(const struct stat64 *buf, struct hostfs_stat *p) 
	p->mtime.tv_nsec = 0;

	p->blksize = buf->st_blksize;

	p->blocks = buf->st_blocks;

	p->maj = os_major(buf->st_rdev);

	p->min = os_minor(buf->st_rdev);

	p->dev = buf->st_dev;

	p->rdev.maj = os_major(buf->st_rdev);

	p->rdev.min = os_minor(buf->st_rdev);

	p->dev.maj = os_major(buf->st_dev);

	p->dev.min = os_minor(buf->st_dev);

}



int stat_file(const char *path, struct hostfs_stat *p, int fd)