From: Amir Goldstein <amir73il@gmail.com> mainline inclusion from mainline-v6.17-rc1 commit 4e301d858af17ae2ce56886296e5458c5a08219a category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15316 CVE: CVE-2026-46054 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- Add internal helper backing_file_set_user_path() for the only two cases that need to modify backing_file fields. Signed-off-by: Amir Goldstein <amir73il@gmail.com> Link: https://lore.kernel.org/20250607115304.2521155-2-amir73il@gmail.com Signed-off-by: Christian Brauner <brauner@kernel.org> Conflicts: fs/backing-file.c fs/file_table.c fs/open.c include/linux/fs.h fs/internal.h [fs/backing-file.c: There is no backing-file.c in 5.10, change the function in fs/open.c. There is no backing_tmpfile_open in 5.10. include/linux/fs.h: There is no file_user_inode function. Others are only context conflicts.] Signed-off-by: Cai Xinchen <caixinchen1@huawei.com> --- fs/file_table.c | 13 ++++++++----- fs/internal.h | 1 + fs/open.c | 2 +- include/linux/fs.h | 4 ++-- 4 files changed, 12 insertions(+), 8 deletions(-) diff --git a/fs/file_table.c b/fs/file_table.c index 4b44beb28844..9af699732a21 100644 --- a/fs/file_table.c +++ b/fs/file_table.c @@ -79,17 +79,20 @@ struct backing_file { struct path user_path; }; -static inline struct backing_file *backing_file(struct file *f) -{ - return container_of(f, struct backing_file, file); -} +#define backing_file(f) container_of(f, struct backing_file, file) -struct path *backing_file_user_path(struct file *f) +struct path *backing_file_user_path(const struct file *f) { return &backing_file(f)->user_path; } EXPORT_SYMBOL_GPL(backing_file_user_path); +void backing_file_set_user_path(struct file *f, const struct path *path) +{ + backing_file(f)->user_path = *path; +} +EXPORT_SYMBOL_GPL(backing_file_set_user_path); + static void file_free_rcu(struct rcu_head *head) { struct file *f = container_of(head, struct file, f_u.fu_rcuhead); diff --git a/fs/internal.h b/fs/internal.h index ee3fd9dcad13..71a0a155ec8f 100644 --- a/fs/internal.h +++ b/fs/internal.h @@ -110,6 +110,7 @@ extern void chroot_fs_refs(const struct path *, const struct path *); struct file *alloc_empty_file(int flags, const struct cred *cred); struct file *alloc_empty_file_noaccount(int flags, const struct cred *cred); struct file *alloc_empty_backing_file(int flags, const struct cred *cred); +void backing_file_set_user_path(struct file *f, const struct path *path); static inline void file_put_write_access(struct file *file) { diff --git a/fs/open.c b/fs/open.c index f056e3b3e114..df3066e5d87a 100644 --- a/fs/open.c +++ b/fs/open.c @@ -996,7 +996,7 @@ struct file *backing_file_open(const struct path *user_path, int flags, return f; path_get(user_path); - *backing_file_user_path(f) = *user_path; + backing_file_set_user_path(f, user_path); f->f_path = *real_path; error = do_dentry_open(f, d_inode(real_path->dentry), NULL); if (error) { diff --git a/include/linux/fs.h b/include/linux/fs.h index 617574e86336..d90265b6c61d 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -2723,7 +2723,7 @@ struct file *dentry_create(const struct path *path, int flags, umode_t mode, struct file *backing_file_open(const struct path *user_path, int flags, const struct path *real_path, const struct cred *cred); -struct path *backing_file_user_path(struct file *f); +struct path *backing_file_user_path(const struct file *f); /* * file_user_path - get the path to display for memory mapped file @@ -2734,7 +2734,7 @@ struct path *backing_file_user_path(struct file *f); * /proc/<pid>/maps), this helper should be used to get the path to display * to the user, which is the path of the fd that user has requested to map. */ -static inline const struct path *file_user_path(struct file *f) +static inline const struct path *file_user_path(const struct file *f) { if (unlikely(f->f_mode & FMODE_BACKING)) return backing_file_user_path(f); -- 2.18.0.huawei.25