Re: [PATCH v2] fs/stat: reject invalid flags for empty paths

[Jan Kara]

On Sun 08-11-26 14:56:18, Avi Weiss wrote:
> vfs_fstatat() and statx() take the file descriptor fast path for empty
> paths when AT_EMPTY_PATH is set. These paths bypass the flag validation
> in vfs_statx(), allowing unsupported flags such as AT_RECURSIVE to
> succeed.
> 
> Return -EINVAL for unsupported flags in the vfs_fstatat() fast path,
> and validate flags in vfs_statx_fd() as is already done in vfs_statx().
> 
> Fixes: e896474fe485 ("getname_maybe_null() - the third variant of pathname copy-in")
> Signed-off-by: Avi Weiss <thnkslprpt@xxxxxxxxx>

Looks good. Feel free to add:

Reviewed-by: Jan Kara <jack@xxxxxxx>

								Honza

> ---
> v2:
> - return -EINVAL directly for unsupported flags in vfs_fstatat()
> - validate flags in vfs_statx_fd() instead of changing statx()
>   dispatch (as suggested by Jan Kara)
> 
>  fs/stat.c | 11 ++++++++++-
>  1 file changed, 10 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/stat.c b/fs/stat.c
> index a2e63c6c45b7..3013e4ece011 100644
> --- a/fs/stat.c
> +++ b/fs/stat.c
> @@ -322,6 +322,11 @@ static int vfs_statx_fd(int fd, int flags, struct kstat *stat,
>  			  u32 request_mask)
>  {
>  	CLASS(fd_raw, f)(fd);
> +
> +	if (flags & ~(AT_SYMLINK_NOFOLLOW | AT_NO_AUTOMOUNT |
> +		      AT_EMPTY_PATH | AT_STATX_SYNC_TYPE))
> +		return -EINVAL;
> +
>  	if (fd_empty(f))
>  		return -EBADF;
>  	return vfs_statx_path(&fd_file(f)->f_path, flags, stat, request_mask);
> @@ -371,8 +376,12 @@ int vfs_fstatat(int dfd, const char __user *filename,
>  {
>  	CLASS(filename_maybe_null, name)(filename, flags);
>  
> -	if (!name && dfd >= 0)
> +	if (!name && dfd >= 0) {
> +		if (flags & ~(AT_SYMLINK_NOFOLLOW | AT_NO_AUTOMOUNT |
> +			      AT_EMPTY_PATH | AT_STATX_SYNC_TYPE))
> +			return -EINVAL;
>  		return vfs_fstat(dfd, stat);
> +	}
>  
>  	return vfs_statx(dfd, name, flags | AT_NO_AUTOMOUNT,
>  			 stat, STATX_BASIC_STATS);
> 
> base-commit: fa4ad798f6f681031775266044ba1b0cf3c670bd
> -- 
> 2.43.0
> 
-- 
Jan Kara <jack@xxxxxxxx>
SUSE Labs, CR