From: Amir Goldstein <amir73il@gmail.com> stable inclusion from stable-v6.12.95 commit 28f020bce41540e6cb27ee2565929c75d11e28d1 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15316 CVE: CVE-2026-46054 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... -------------------------------- [ Upstream commit 4e301d858af17ae2ce56886296e5458c5a08219a ] Add internal helper backing_file_set_user_path() for the only two cases that need to modify backing_file fields. Signed-off-by: Amir Goldstein <amir73il@gmail.com> Link: https://lore.kernel.org/20250607115304.2521155-2-amir73il@gmail.com Signed-off-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Cai Xinchen <caixinchen1@huawei.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Conflicts: fs/backing-file.c fs/file_table.c include/linux/fs.h [The function backing_tmpfile_open is not backport in OLK-6.6. Others are context conflicts.] Signed-off-by: Cai Xinchen <caixinchen1@huawei.com> --- fs/backing-file.c | 2 +- fs/file_table.c | 13 ++++++++----- fs/internal.h | 1 + include/linux/fs.h | 4 ++-- 4 files changed, 12 insertions(+), 8 deletions(-) diff --git a/fs/backing-file.c b/fs/backing-file.c index e1a4b23b255b..210cc39848d1 100644 --- a/fs/backing-file.c +++ b/fs/backing-file.c @@ -41,7 +41,7 @@ struct file *backing_file_open(const struct path *user_path, int flags, return f; path_get(user_path); - *backing_file_user_path(f) = *user_path; + backing_file_set_user_path(f, user_path); error = vfs_open(real_path, f); if (error) { fput(f); diff --git a/fs/file_table.c b/fs/file_table.c index 9b558a64cae9..fc8c9730802e 100644 --- a/fs/file_table.c +++ b/fs/file_table.c @@ -50,17 +50,20 @@ struct backing_file { struct path user_path; }; -static inline struct backing_file *backing_file(struct file *f) -{ - return container_of(f, struct backing_file, file); -} +#define backing_file(f) container_of(f, struct backing_file, file) -struct path *backing_file_user_path(struct file *f) +struct path *backing_file_user_path(const struct file *f) { return &backing_file(f)->user_path; } EXPORT_SYMBOL_GPL(backing_file_user_path); +void backing_file_set_user_path(struct file *f, const struct path *path) +{ + backing_file(f)->user_path = *path; +} +EXPORT_SYMBOL_GPL(backing_file_set_user_path); + static void file_free_rcu(struct rcu_head *head) { struct file *f = container_of(head, struct file, f_rcuhead); diff --git a/fs/internal.h b/fs/internal.h index 68f51bf7c5b0..76c0ea67a09d 100644 --- a/fs/internal.h +++ b/fs/internal.h @@ -95,6 +95,7 @@ extern void chroot_fs_refs(const struct path *, const struct path *); struct file *alloc_empty_file(int flags, const struct cred *cred); struct file *alloc_empty_file_noaccount(int flags, const struct cred *cred); struct file *alloc_empty_backing_file(int flags, const struct cred *cred); +void backing_file_set_user_path(struct file *f, const struct path *path); static inline void file_put_write_access(struct file *file) { diff --git a/include/linux/fs.h b/include/linux/fs.h index 9c349a5fcc94..5a43fda15809 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -2657,7 +2657,7 @@ struct file *dentry_open(const struct path *path, int flags, const struct cred *creds); struct file *dentry_create(const struct path *path, int flags, umode_t mode, const struct cred *cred); -struct path *backing_file_user_path(struct file *f); +struct path *backing_file_user_path(const struct file *f); /* * file_user_path - get the path to display for memory mapped file @@ -2668,7 +2668,7 @@ struct path *backing_file_user_path(struct file *f); * /proc/<pid>/maps), this helper should be used to get the path to display * to the user, which is the path of the fd that user has requested to map. */ -static inline const struct path *file_user_path(struct file *f) +static inline const struct path *file_user_path(const struct file *f) { if (unlikely(f->f_mode & FMODE_BACKING)) return backing_file_user_path(f); -- 2.18.0.huawei.25