[PATCH v2] fs/stat: reject invalid flags for empty paths

[PATCH v2] fs/stat: reject invalid flags for empty paths

[Avi Weiss]

vfs_fstatat() and statx() take the file descriptor fast path for empty
paths when AT_EMPTY_PATH is set. These paths bypass the flag validation
in vfs_statx(), allowing unsupported flags such as AT_RECURSIVE to
succeed.

Return -EINVAL for unsupported flags in the vfs_fstatat() fast path,
and validate flags in vfs_statx_fd() as is already done in vfs_statx().

Fixes: e896474fe485 ("getname_maybe_null() - the third variant of pathname copy-in")
Signed-off-by: Avi Weiss <thnkslprpt@gmail.com>
---
v2:
- return -EINVAL directly for unsupported flags in vfs_fstatat()
- validate flags in vfs_statx_fd() instead of changing statx()
  dispatch (as suggested by Jan Kara)

 fs/stat.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/fs/stat.c b/fs/stat.c
index a2e63c6c45b7..3013e4ece011 100644
--- a/fs/stat.c
+++ b/fs/stat.c
@@ -322,6 +322,11 @@ static int vfs_statx_fd(int fd, int flags, struct kstat *stat,
 			  u32 request_mask)
 {
 	CLASS(fd_raw, f)(fd);
+
+	if (flags & ~(AT_SYMLINK_NOFOLLOW | AT_NO_AUTOMOUNT |
+		      AT_EMPTY_PATH | AT_STATX_SYNC_TYPE))
+		return -EINVAL;
+
 	if (fd_empty(f))
 		return -EBADF;
 	return vfs_statx_path(&fd_file(f)->f_path, flags, stat, request_mask);
@@ -371,8 +376,12 @@ int vfs_fstatat(int dfd, const char __user *filename,
 {
 	CLASS(filename_maybe_null, name)(filename, flags);
 
-	if (!name && dfd >= 0)
+	if (!name && dfd >= 0) {
+		if (flags & ~(AT_SYMLINK_NOFOLLOW | AT_NO_AUTOMOUNT |
+			      AT_EMPTY_PATH | AT_STATX_SYNC_TYPE))
+			return -EINVAL;
 		return vfs_fstat(dfd, stat);
+	}
 
 	return vfs_statx(dfd, name, flags | AT_NO_AUTOMOUNT,
 			 stat, STATX_BASIC_STATS);

base-commit: fa4ad798f6f681031775266044ba1b0cf3c670bd
-- 
2.43.0