[PATCH v2] statx: don't leak STATX_ATTR_CHANGE_MONOTONIC in stx_attributes_mask

[PATCH v2] statx: don't leak STATX_ATTR_CHANGE_MONOTONIC in stx_attributes_mask

[Jeff Layton]

STATX_ATTR_CHANGE_MONOTONIC is kernel-internal. cp_statx() strips it
from stx_attributes but copies attributes_mask verbatim, so it leaks to
userland on filesystems that advertise it (nfs, ceph), e.g.
stx_attributes_mask = 0x8000000000303000 on NFS.

Add a new mask constant and apply it to both fields.

Fixes: a1175d6b1bda ("vfs: plumb i_version handling into struct kstat")
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
---
Changes in v2:
- Add new STATX_ATTR_INTERNAL_MASK constant
- Keep lines below 80 columns
- Link to v1: https://lore.kernel.org/r/20261029-statx-v1-1-9600cdb896b3@kernel.org
---
 fs/stat.c            | 6 +++---
 include/linux/stat.h | 3 +++
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/fs/stat.c b/fs/stat.c
index a2e63c6c45b7..34d786c1de3e 100644
--- a/fs/stat.c
+++ b/fs/stat.c
@@ -710,8 +710,7 @@ cp_statx(const struct kstat *stat, struct statx __user *buffer)
 	/* STATX_CHANGE_COOKIE is kernel-only for now */
 	tmp.stx_mask = stat->result_mask & ~STATX_CHANGE_COOKIE;
 	tmp.stx_blksize = stat->blksize;
-	/* STATX_ATTR_CHANGE_MONOTONIC is kernel-only for now */
-	tmp.stx_attributes = stat->attributes & ~STATX_ATTR_CHANGE_MONOTONIC;
+	tmp.stx_attributes = stat->attributes & ~STATX_ATTR_INTERNAL_MASK;
 	tmp.stx_nlink = stat->nlink;
 	tmp.stx_uid = from_kuid_munged(current_user_ns(), stat->uid);
 	tmp.stx_gid = from_kgid_munged(current_user_ns(), stat->gid);
@@ -719,7 +718,8 @@ cp_statx(const struct kstat *stat, struct statx __user *buffer)
 	tmp.stx_ino = stat->ino;
 	tmp.stx_size = stat->size;
 	tmp.stx_blocks = stat->blocks;
-	tmp.stx_attributes_mask = stat->attributes_mask;
+	tmp.stx_attributes_mask = stat->attributes_mask &
+				  ~STATX_ATTR_INTERNAL_MASK;
 	tmp.stx_atime.tv_sec = stat->atime.tv_sec;
 	tmp.stx_atime.tv_nsec = stat->atime.tv_nsec;
 	tmp.stx_btime.tv_sec = stat->btime.tv_sec;
diff --git a/include/linux/stat.h b/include/linux/stat.h
index 9c5709132862..4f0a4af7a067 100644
--- a/include/linux/stat.h
+++ b/include/linux/stat.h
@@ -69,4 +69,7 @@ struct kstat {
 /* file attribute values */
 #define STATX_ATTR_CHANGE_MONOTONIC	0x8000000000000000ULL /* version monotonically increases */
 
+/* mask of STATX_ATTR_* bits that is private to the kernel */
+#define STATX_ATTR_INTERNAL_MASK	(STATX_ATTR_CHANGE_MONOTONIC)
+
 #endif

---
base-commit: c339f4010dea8b0d754f84ace70cd1b089878ef8
change-id: 20261029-statx-3f1d8cd8d877

Best regards,
-- 
Jeff Layton <jlayton@kernel.org>

Re: [PATCH v2] statx: don't leak STATX_ATTR_CHANGE_MONOTONIC in stx_attributes_mask

[Christoph Hellwig]

On Tue, Nov 03, 2026 at 07:04:00AM -0500, Jeff Layton wrote:
> STATX_ATTR_CHANGE_MONOTONIC is kernel-internal. cp_statx() strips it
> from stx_attributes but copies attributes_mask verbatim, so it leaks to
> userland on filesystems that advertise it (nfs, ceph), e.g.
> stx_attributes_mask = 0x8000000000303000 on NFS.
> 
> Add a new mask constant and apply it to both fields.

Looks good:

Reviewed-by: Christoph Hellwig <hch@lst.de>