From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Mikulas Patocka <mpatocka@redhat.com>,
Andreas Schwab <schwab@linux-m68k.org>,
Matthew Wilcox <willy@infradead.org>,
Christoph Hellwig <hch@infradead.org>,
Linus Torvalds <torvalds@linux-foundation.org>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 4.14 21/43] stat: fix inconsistency between struct stat and struct compat_stat
Date: Tue, 26 Apr 2022 10:21:03 +0200 [thread overview]
Message-ID: <20220426081735.144377017@linuxfoundation.org> (raw)
In-Reply-To: <20220426081734.509314186@linuxfoundation.org>
From: Mikulas Patocka <mpatocka@redhat.com>
[ Upstream commit 932aba1e169090357a77af18850a10c256b50819 ]
struct stat (defined in arch/x86/include/uapi/asm/stat.h) has 32-bit
st_dev and st_rdev; struct compat_stat (defined in
arch/x86/include/asm/compat.h) has 16-bit st_dev and st_rdev followed by
a 16-bit padding.
This patch fixes struct compat_stat to match struct stat.
[ Historical note: the old x86 'struct stat' did have that 16-bit field
that the compat layer had kept around, but it was changes back in 2003
by "struct stat - support larger dev_t":
https://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git/commit/?id=e95b2065677fe32512a597a79db94b77b90c968d
and back in those days, the x86_64 port was still new, and separate
from the i386 code, and had already picked up the old version with a
16-bit st_dev field ]
Note that we can't change compat_dev_t because it is used by
compat_loop_info.
Also, if the st_dev and st_rdev values are 32-bit, we don't have to use
old_valid_dev to test if the value fits into them. This fixes
-EOVERFLOW on filesystems that are on NVMe because NVMe uses the major
number 259.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: Andreas Schwab <schwab@linux-m68k.org>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Christoph Hellwig <hch@infradead.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/include/asm/compat.h | 6 ++----
fs/stat.c | 19 ++++++++++---------
2 files changed, 12 insertions(+), 13 deletions(-)
diff --git a/arch/x86/include/asm/compat.h b/arch/x86/include/asm/compat.h
index 2cbd75dd2fd3..ea142936bf11 100644
--- a/arch/x86/include/asm/compat.h
+++ b/arch/x86/include/asm/compat.h
@@ -57,15 +57,13 @@ struct compat_timeval {
};
struct compat_stat {
- compat_dev_t st_dev;
- u16 __pad1;
+ u32 st_dev;
compat_ino_t st_ino;
compat_mode_t st_mode;
compat_nlink_t st_nlink;
__compat_uid_t st_uid;
__compat_gid_t st_gid;
- compat_dev_t st_rdev;
- u16 __pad2;
+ u32 st_rdev;
u32 st_size;
u32 st_blksize;
u32 st_blocks;
diff --git a/fs/stat.c b/fs/stat.c
index 873785dae022..0fda4b6b8fb2 100644
--- a/fs/stat.c
+++ b/fs/stat.c
@@ -286,9 +286,6 @@ SYSCALL_DEFINE2(fstat, unsigned int, fd, struct __old_kernel_stat __user *, stat
# define choose_32_64(a,b) b
#endif
-#define valid_dev(x) choose_32_64(old_valid_dev(x),true)
-#define encode_dev(x) choose_32_64(old_encode_dev,new_encode_dev)(x)
-
#ifndef INIT_STRUCT_STAT_PADDING
# define INIT_STRUCT_STAT_PADDING(st) memset(&st, 0, sizeof(st))
#endif
@@ -297,7 +294,9 @@ static int cp_new_stat(struct kstat *stat, struct stat __user *statbuf)
{
struct stat tmp;
- if (!valid_dev(stat->dev) || !valid_dev(stat->rdev))
+ if (sizeof(tmp.st_dev) < 4 && !old_valid_dev(stat->dev))
+ return -EOVERFLOW;
+ if (sizeof(tmp.st_rdev) < 4 && !old_valid_dev(stat->rdev))
return -EOVERFLOW;
#if BITS_PER_LONG == 32
if (stat->size > MAX_NON_LFS)
@@ -305,7 +304,7 @@ static int cp_new_stat(struct kstat *stat, struct stat __user *statbuf)
#endif
INIT_STRUCT_STAT_PADDING(tmp);
- tmp.st_dev = encode_dev(stat->dev);
+ tmp.st_dev = new_encode_dev(stat->dev);
tmp.st_ino = stat->ino;
if (sizeof(tmp.st_ino) < sizeof(stat->ino) && tmp.st_ino != stat->ino)
return -EOVERFLOW;
@@ -315,7 +314,7 @@ static int cp_new_stat(struct kstat *stat, struct stat __user *statbuf)
return -EOVERFLOW;
SET_UID(tmp.st_uid, from_kuid_munged(current_user_ns(), stat->uid));
SET_GID(tmp.st_gid, from_kgid_munged(current_user_ns(), stat->gid));
- tmp.st_rdev = encode_dev(stat->rdev);
+ tmp.st_rdev = new_encode_dev(stat->rdev);
tmp.st_size = stat->size;
tmp.st_atime = stat->atime.tv_sec;
tmp.st_mtime = stat->mtime.tv_sec;
@@ -582,11 +581,13 @@ static int cp_compat_stat(struct kstat *stat, struct compat_stat __user *ubuf)
{
struct compat_stat tmp;
- if (!old_valid_dev(stat->dev) || !old_valid_dev(stat->rdev))
+ if (sizeof(tmp.st_dev) < 4 && !old_valid_dev(stat->dev))
+ return -EOVERFLOW;
+ if (sizeof(tmp.st_rdev) < 4 && !old_valid_dev(stat->rdev))
return -EOVERFLOW;
memset(&tmp, 0, sizeof(tmp));
- tmp.st_dev = old_encode_dev(stat->dev);
+ tmp.st_dev = new_encode_dev(stat->dev);
tmp.st_ino = stat->ino;
if (sizeof(tmp.st_ino) < sizeof(stat->ino) && tmp.st_ino != stat->ino)
return -EOVERFLOW;
@@ -596,7 +597,7 @@ static int cp_compat_stat(struct kstat *stat, struct compat_stat __user *ubuf)
return -EOVERFLOW;
SET_UID(tmp.st_uid, from_kuid_munged(current_user_ns(), stat->uid));
SET_GID(tmp.st_gid, from_kgid_munged(current_user_ns(), stat->gid));
- tmp.st_rdev = old_encode_dev(stat->rdev);
+ tmp.st_rdev = new_encode_dev(stat->rdev);
if ((u64) stat->size > MAX_NON_LFS)
return -EOVERFLOW;
tmp.st_size = stat->size;
--
2.35.1
next prev parent reply other threads:[~2022-04-26 8:27 UTC|newest]
Thread overview: 48+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-04-26 8:20 [PATCH 4.14 00/43] 4.14.277-rc1 review Greg Kroah-Hartman
2022-04-26 8:20 ` [PATCH 4.14 01/43] etherdevice: Adjust ether_addr* prototypes to silence -Wstringop-overead Greg Kroah-Hartman
2022-04-26 8:20 ` [PATCH 4.14 02/43] mm: page_alloc: fix building error on -Werror=array-compare Greg Kroah-Hartman
2022-04-26 8:20 ` [PATCH 4.14 03/43] tracing: Have traceon and traceoff trigger honor the instance Greg Kroah-Hartman
2022-04-26 8:20 ` [PATCH 4.14 04/43] tracing: Dump stacktrace trigger to the corresponding instance Greg Kroah-Hartman
2022-04-26 8:20 ` [PATCH 4.14 05/43] can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error path Greg Kroah-Hartman
2022-04-26 8:20 ` [PATCH 4.14 06/43] gfs2: assign rgrp glock before compute_bitstructs Greg Kroah-Hartman
2022-04-26 8:20 ` [PATCH 4.14 07/43] ALSA: usb-audio: Clear MIDI port active flag after draining Greg Kroah-Hartman
2022-04-26 8:20 ` [PATCH 4.14 08/43] tcp: fix race condition when creating child sockets from syncookies Greg Kroah-Hartman
2022-04-26 8:20 ` [PATCH 4.14 09/43] tcp: Fix potential use-after-free due to double kfree() Greg Kroah-Hartman
2022-04-26 8:20 ` [PATCH 4.14 10/43] dmaengine: imx-sdma: Fix error checking in sdma_event_remap Greg Kroah-Hartman
2022-04-26 8:20 ` [PATCH 4.14 11/43] net/packet: fix packet_sock xmit return value checking Greg Kroah-Hartman
2022-04-26 8:20 ` [PATCH 4.14 12/43] netlink: reset network and mac headers in netlink_dump() Greg Kroah-Hartman
2022-04-26 8:20 ` [PATCH 4.14 13/43] ARM: vexpress/spc: Avoid negative array index when !SMP Greg Kroah-Hartman
2022-04-26 8:20 ` Greg Kroah-Hartman
2022-04-26 8:20 ` [PATCH 4.14 14/43] platform/x86: samsung-laptop: Fix an unsigned comparison which can never be negative Greg Kroah-Hartman
2022-04-26 8:20 ` [PATCH 4.14 15/43] ALSA: usb-audio: Fix undefined behavior due to shift overflowing the constant Greg Kroah-Hartman
2022-04-26 8:20 ` [PATCH 4.14 16/43] vxlan: fix error return code in vxlan_fdb_append Greg Kroah-Hartman
2022-04-26 8:20 ` [PATCH 4.14 17/43] cifs: Check the IOCB_DIRECT flag, not O_DIRECT Greg Kroah-Hartman
2022-04-26 8:21 ` [PATCH 4.14 18/43] brcmfmac: sdio: Fix undefined behavior due to shift overflowing the constant Greg Kroah-Hartman
2022-04-26 8:21 ` [PATCH 4.14 19/43] drm/msm/mdp5: check the return of kzalloc() Greg Kroah-Hartman
2022-04-26 8:21 ` [PATCH 4.14 20/43] net: macb: Restart tx only if queue pointer is lagging Greg Kroah-Hartman
2022-04-26 8:21 ` Greg Kroah-Hartman [this message]
2022-04-26 8:21 ` [PATCH 4.14 22/43] ata: pata_marvell: Check the bmdma_addr beforing reading Greg Kroah-Hartman
2022-04-26 8:21 ` [PATCH 4.14 23/43] dma: at_xdmac: fix a missing check on list iterator Greg Kroah-Hartman
2022-04-26 8:21 ` [PATCH 4.14 24/43] powerpc/perf: Fix power9 event alternatives Greg Kroah-Hartman
2022-04-26 8:21 ` [PATCH 4.14 25/43] openvswitch: fix OOB access in reserve_sfa_size() Greg Kroah-Hartman
2022-04-26 8:21 ` [PATCH 4.14 26/43] ASoC: soc-dapm: fix two incorrect uses of list iterator Greg Kroah-Hartman
2022-04-26 8:21 ` [PATCH 4.14 27/43] e1000e: Fix possible overflow in LTR decoding Greg Kroah-Hartman
2022-04-26 8:21 ` [PATCH 4.14 28/43] ARC: entry: fix syscall_trace_exit argument Greg Kroah-Hartman
2022-04-26 8:21 ` [PATCH 4.14 29/43] ext4: fix symlink file size not match to file content Greg Kroah-Hartman
2022-04-26 8:21 ` [PATCH 4.14 30/43] ext4: limit length to bitmap_maxbytes - blocksize in punch_hole Greg Kroah-Hartman
2022-04-26 8:21 ` [PATCH 4.14 31/43] ext4: fix overhead calculation to account for the reserved gdt blocks Greg Kroah-Hartman
2022-04-26 8:21 ` [PATCH 4.14 32/43] ext4: force overhead calculation if the s_overhead_cluster makes no sense Greg Kroah-Hartman
2022-04-26 8:21 ` [PATCH 4.14 33/43] staging: ion: Prevent incorrect reference counting behavour Greg Kroah-Hartman
2022-04-26 8:21 ` [PATCH 4.14 34/43] block/compat_ioctl: fix range check in BLKGETSIZE Greg Kroah-Hartman
2022-04-26 8:21 ` [PATCH 4.14 35/43] ax25: add refcount in ax25_dev to avoid UAF bugs Greg Kroah-Hartman
2022-04-26 8:21 ` [PATCH 4.14 36/43] ax25: fix reference count leaks of ax25_dev Greg Kroah-Hartman
2022-04-26 8:21 ` [PATCH 4.14 37/43] ax25: fix UAF bugs of net_device caused by rebinding operation Greg Kroah-Hartman
2022-04-26 8:21 ` [PATCH 4.14 38/43] ax25: Fix refcount leaks caused by ax25_cb_del() Greg Kroah-Hartman
2022-04-26 8:21 ` [PATCH 4.14 39/43] ax25: fix UAF bug in ax25_send_control() Greg Kroah-Hartman
2022-04-26 8:21 ` [PATCH 4.14 40/43] ax25: fix NPD bug in ax25_disconnect Greg Kroah-Hartman
2022-04-26 8:21 ` [PATCH 4.14 41/43] ax25: Fix NULL pointer dereferences in ax25 timers Greg Kroah-Hartman
2022-04-26 8:21 ` [PATCH 4.14 42/43] ax25: Fix UAF bugs " Greg Kroah-Hartman
2022-04-26 8:21 ` [PATCH 4.14 43/43] Revert "net: micrel: fix KS8851_MLL Kconfig" Greg Kroah-Hartman
2022-04-26 16:20 ` [PATCH 4.14 00/43] 4.14.277-rc1 review Jon Hunter
2022-04-26 20:11 ` Guenter Roeck
2022-04-27 8:52 ` Naresh Kamboju
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220426081735.144377017@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=hch@infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mpatocka@redhat.com \
--cc=sashal@kernel.org \
--cc=schwab@linux-m68k.org \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=willy@infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.