Re: [PATCH v2] xfs: fix wrong compat fields in xfs_ioctl32_bstat_copyin()

[David Laight]

On Tue, 27 Oct 2026 12:17:48 -0400
Reid Downing <skibletz@xxxxxxxxx> wrote:

> bs_blocks and bs_xflags were both read from bstat32->bs_size.
> Read each one from its own field instead.

It would be much better to do a single copy_from_user() of the entire
compat structure and copy the fields to the standard one.

The function would need to be 'noinline_for_stack'.

David
 
> 
> Fixes: e94fc4a43e5c39 ("[XFS] Add compat handlers for swapext ioctl")
> Cc: <stable@xxxxxxxxxxxxxxx> # v2.6.29
> Signed-off-by: Reid Downing <skibletz@xxxxxxxxx>
> ---
> v2:
>  - Also fix bs_blocks (spotted by Eric Sandeen)
> 
>  fs/xfs/xfs_ioctl32.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/xfs/xfs_ioctl32.c b/fs/xfs/xfs_ioctl32.c
> index f6875a2cc70..77bc936bf0d 100644
> --- a/fs/xfs/xfs_ioctl32.c
> +++ b/fs/xfs/xfs_ioctl32.c
> @@ -143,8 +143,8 @@ xfs_ioctl32_bstat_copyin(
>  	    xfs_ioctl32_bstime_copyin(&bstat->bs_atime, &bstat32->bs_atime) ||
>  	    xfs_ioctl32_bstime_copyin(&bstat->bs_mtime, &bstat32->bs_mtime) ||
>  	    xfs_ioctl32_bstime_copyin(&bstat->bs_ctime, &bstat32->bs_ctime) ||
> -	    get_user(bstat->bs_blocks,	&bstat32->bs_size)	||
> -	    get_user(bstat->bs_xflags,	&bstat32->bs_size)	||
> +	    get_user(bstat->bs_blocks,	&bstat32->bs_blocks)	||
> +	    get_user(bstat->bs_xflags,	&bstat32->bs_xflags)	||
>  	    get_user(bstat->bs_extsize,	&bstat32->bs_extsize)	||
>  	    get_user(bstat->bs_extents,	&bstat32->bs_extents)	||
>  	    get_user(bstat->bs_gen,	&bstat32->bs_gen)	||