Bug 472795

+++ This bug was initially created as a clone of Bug #472426 +++

Found this by running a 32-bit xfs_logprint on a 64-bit kernel:

# xfs_logprint /dev/loop0
xfs_logprint:
*** stack smashing detected ***: xfs_logprint terminated
Aborted (core dumped)

The problem here is that there is no sys_compat_ustat, and the kernel copies out a structure larger than userspace has provided:

32-bit ustat struct from userspace:

struct ustat {
        __daddr_t                  f_tfree;              /*     0     4 */
        __ino_t                    f_tinode;             /*     4     4 */
        char                       f_fname[6];           /*     8     6 */
        char                       f_fpack[6];           /*    14     6 */

        /* size: 20, cachelines: 1 */
        /* last cacheline: 20 bytes */
};

kernel ustat struct:

struct ustat {
        __kernel_daddr_t           f_tfree;              /*     0     4 */

        /* XXX 4 bytes hole, try to pack */

        __kernel_ino_t             f_tinode;             /*     8     8 */
        char                       f_fname[6];           /*    16     6 */
        char                       f_fpack[6];           /*    22     6 */

        /* size: 32, cachelines: 1 */
        /* sum members: 24, holes: 1, sum holes: 4 */
        /* padding: 4 */
        /* last cacheline: 32 bytes */
};

... so userspace is corrupted when this syscall is called.

Christoph Hellwig mentioned that he might take a stab at fixing it, since he's done other compat syscalls, but not sure on what schedule, so perhaps I (or our ppc maintainer, if we have one...?) can take a look at the fix.

--- Additional comment from esandeen on 2008-11-20 15:12:27 EDT ---

See also http://rhts.redhat.com/cgi-bin/rhts/test_log.cgi?id=5087037

--- Additional comment from esandeen on 2008-11-20 22:00:46 EDT ---

I've tested the patch in comment #3 on ppc, and it resolves the issue I saw.