[PATCH] statx: don't leak STATX_ATTR_CHANGE_MONOTONIC in stx_attributes_mask

[PATCH] statx: don't leak STATX_ATTR_CHANGE_MONOTONIC in stx_attributes_mask

[Jeff Layton]

STATX_ATTR_CHANGE_MONOTONIC is kernel-internal. cp_statx() strips it
from stx_attributes but copies attributes_mask verbatim, so it leaks to
userland on filesystems that advertise it (nfs, ceph), e.g.
stx_attributes_mask = 0x8000000000b03000 on NFS.

Mask it out of stx_attributes_mask too.

Fixes: a1175d6b1bda ("vfs: plumb i_version handling into struct kstat")
Signed-off-by: Jeff Layton <jlayton@kernel.org>
---
 fs/stat.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/stat.c b/fs/stat.c
index a2e63c6c45b7..787c13f378ff 100644
--- a/fs/stat.c
+++ b/fs/stat.c
@@ -719,7 +719,7 @@ cp_statx(const struct kstat *stat, struct statx __user *buffer)
 	tmp.stx_ino = stat->ino;
 	tmp.stx_size = stat->size;
 	tmp.stx_blocks = stat->blocks;
-	tmp.stx_attributes_mask = stat->attributes_mask;
+	tmp.stx_attributes_mask = stat->attributes_mask & ~STATX_ATTR_CHANGE_MONOTONIC;
 	tmp.stx_atime.tv_sec = stat->atime.tv_sec;
 	tmp.stx_atime.tv_nsec = stat->atime.tv_nsec;
 	tmp.stx_btime.tv_sec = stat->btime.tv_sec;

---
base-commit: c339f4010dea8b0d754f84ace70cd1b089878ef8
change-id: 20261029-statx-3f1d8cd8d877

Best regards,
-- 
Jeff Layton <jlayton@kernel.org>

Re: [PATCH] statx: don't leak STATX_ATTR_CHANGE_MONOTONIC in stx_attributes_mask

[Jan Kara]

On Thu 29-10-26 12:20:27, Jeff Layton wrote:
> STATX_ATTR_CHANGE_MONOTONIC is kernel-internal. cp_statx() strips it
> from stx_attributes but copies attributes_mask verbatim, so it leaks to
> userland on filesystems that advertise it (nfs, ceph), e.g.
> stx_attributes_mask = 0x8000000000b03000 on NFS.
> 
> Mask it out of stx_attributes_mask too.
> 
> Fixes: a1175d6b1bda ("vfs: plumb i_version handling into struct kstat")
> Signed-off-by: Jeff Layton <jlayton@kernel.org>

OK, feel free to add:

Reviewed-by: Jan Kara <jack@suse.cz>

								Honza

> ---
>  fs/stat.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/stat.c b/fs/stat.c
> index a2e63c6c45b7..787c13f378ff 100644
> --- a/fs/stat.c
> +++ b/fs/stat.c
> @@ -719,7 +719,7 @@ cp_statx(const struct kstat *stat, struct statx __user *buffer)
>  	tmp.stx_ino = stat->ino;
>  	tmp.stx_size = stat->size;
>  	tmp.stx_blocks = stat->blocks;
> -	tmp.stx_attributes_mask = stat->attributes_mask;
> +	tmp.stx_attributes_mask = stat->attributes_mask & ~STATX_ATTR_CHANGE_MONOTONIC;
>  	tmp.stx_atime.tv_sec = stat->atime.tv_sec;
>  	tmp.stx_atime.tv_nsec = stat->atime.tv_nsec;
>  	tmp.stx_btime.tv_sec = stat->btime.tv_sec;
> 
> ---
> base-commit: c339f4010dea8b0d754f84ace70cd1b089878ef8
> change-id: 20261029-statx-3f1d8cd8d877
> 
> Best regards,
> -- 
> Jeff Layton <jlayton@kernel.org>
> 
-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR

Re: [PATCH] statx: don't leak STATX_ATTR_CHANGE_MONOTONIC in stx_attributes_mask

[Christoph Hellwig]

On Thu, Oct 29, 2026 at 12:20:27PM -0400, Jeff Layton wrote:
> STATX_ATTR_CHANGE_MONOTONIC is kernel-internal. cp_statx() strips it
> from stx_attributes but copies attributes_mask verbatim, so it leaks to
> userland on filesystems that advertise it (nfs, ceph), e.g.
> stx_attributes_mask = 0x8000000000b03000 on NFS.
> 
> Mask it out of stx_attributes_mask too.


This actually seems like useful information, any reason it is not
reported?  We'd probably want to renumber if for that, though.

>  	tmp.stx_blocks = stat->blocks;
> -	tmp.stx_attributes_mask = stat->attributes_mask;
> +	tmp.stx_attributes_mask = stat->attributes_mask & ~STATX_ATTR_CHANGE_MONOTONIC;

But if we want to keep internal only flags, they should have a mask
defined next to the attributes intead of open coding specific ones here.

And please avoid the overly long line as well.

Re: [PATCH] statx: don't leak STATX_ATTR_CHANGE_MONOTONIC in stx_attributes_mask

[Jeff Layton]

On Mon, 2026-11-02 at 23:46 -0800, Christoph Hellwig wrote:
> On Thu, Oct 29, 2026 at 12:20:27PM -0400, Jeff Layton wrote:
> > STATX_ATTR_CHANGE_MONOTONIC is kernel-internal. cp_statx() strips it
> > from stx_attributes but copies attributes_mask verbatim, so it leaks to
> > userland on filesystems that advertise it (nfs, ceph), e.g.
> > stx_attributes_mask = 0x8000000000b03000 on NFS.
> > 
> > Mask it out of stx_attributes_mask too.
> 
> 
> This actually seems like useful information, any reason it is not
> reported?  We'd probably want to renumber if for that, though.
> 

Because we don't report the change attribute itself. There's no reason
to report whether it's monotonic if userspace can't get to it in the
first place.

> >  	tmp.stx_blocks = stat->blocks;
> > -	tmp.stx_attributes_mask = stat->attributes_mask;
> > +	tmp.stx_attributes_mask = stat->attributes_mask & ~STATX_ATTR_CHANGE_MONOTONIC;
> 
> But if we want to keep internal only flags, they should have a mask
> defined next to the attributes intead of open coding specific ones here.
> 
> And please avoid the overly long line as well.

Alrighty, I'll post a v2.
-- 
Jeff Layton <jlayton@kernel.org>