[fuse-devel] [PATCH] fuse: Fix IOC_[GS]ETFLAGS argument size brokenness

[Darrick J. W. <dar...@or...>]

The IOC_[GS]ETFLAGS ioctls, despite being defined to take a "long"
parameter, actually take "int" parameters.  FUSE unfortunately assumed
that the ioctl definitions never lie, and transfers a long's worth of
data in and out of userspace, which causes stack smashing in chattr,
and other bugs elsewhere.

So, special-case this in FUSE, and document this int/long quirk in
include/uapi/linux/fs.h.

Signed-off-by: Darrick J. Wong <dar...@or...>
---
 fs/fuse/file.c          |   11 +++++++++++
 include/uapi/linux/fs.h |    1 +
 2 files changed, 12 insertions(+)

diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 7e70506..5fa8181 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -2385,6 +2385,17 @@ long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg,
 		iov->iov_base = (void __user *)arg;
 		iov->iov_len = _IOC_SIZE(cmd);
 
+		/*
+		 * The IOC_[GS]ETFLAGS ioctls take int parameters even though
+		 * the ioctl definition specifies long.  Userland has been
+		 * expecting int for ages (and chattr segfaults on FUSE
+		 * filesystems), so special case that here.  The IOC32
+		 * variants were declared with int, so they don't need this.
+		 */
+		if (cmd == FS_IOC_GETFLAGS || cmd == FS_IOC_SETFLAGS) {
+			iov->iov_len = sizeof(int);
+		}
+
 		if (_IOC_DIR(cmd) & _IOC_WRITE) {
 			in_iov = iov;
 			in_iovs = 1;
diff --git a/include/uapi/linux/fs.h b/include/uapi/linux/fs.h
index 6c28b61..bc8aa8e 100644
--- a/include/uapi/linux/fs.h
+++ b/include/uapi/linux/fs.h
@@ -154,6 +154,7 @@ struct inodes_stat_t {
 #define FITHAW		_IOWR('X', 120, int)	/* Thaw */
 #define FITRIM		_IOWR('X', 121, struct fstrim_range)	/* Trim */
 
+/* IOC_[GS]ETFLAGS take an int argument despite being defined to take long. */
 #define	FS_IOC_GETFLAGS			_IOR('f', 1, long)
 #define	FS_IOC_SETFLAGS			_IOW('f', 2, long)
 #define	FS_IOC_GETVERSION		_IOR('v', 1, long)