@@ -45,7 +45,7 @@
int fgetversion(const char *name, unsigned long *version)
{
- unsigned int ver = -1;
+ long ver = 0;
int rc = -1;
#if HAVE_EXT2_IOCTLS
# if !APPLE_DARWIN
@@ -68,7 +68,7 @@ int fgetversion(const char *name, unsigned long *version)
errno = EOPNOTSUPP;
#endif /* ! HAVE_EXT2_IOCTLS */
if (rc == 0)
- *version = ver;
+ *version = (unsigned long)ver & 0xffffffffUL;
return rc;
}
@@ -47,12 +47,13 @@ int fsetversion (const char * name, unsigned long version)
{
#if HAVE_EXT2_IOCTLS
#if !APPLE_DARWIN
- int fd, r, ver, save_errno = 0;
+ int fd, r, save_errno = 0;
+ long ver;
fd = open (name, OPEN_FLAGS);
if (fd == -1)
return -1;
- ver = (int) version;
+ ver = (long) (version & 0xffffffffUL);
r = ioctl (fd, EXT2_IOC_SETVERSION, &ver);
if (r == -1)
save_errno = errno;
@@ -61,7 +62,7 @@ int fsetversion (const char * name, unsigned long version)
errno = save_errno;
return r;
#else
- int ver = (int)version;
+ long ver = (long)(version & 0xffffffffUL);
return syscall(SYS_fsctl, name, EXT2_IOC_SETVERSION, &ver, 0);
#endif
#else /* ! HAVE_EXT2_IOCTLS */
When using utilities like lsattr/chattr on a FUSE backing file-system, invoking the fgetversion or fsetversion functions can result in an abort crash due to "*** stack smashing detected ***". The underlying cause lies in a data structure mismatch between the variable allocation space in user-space and the ioctl encoding expectations defined by Linux: the ioctl command token incorporates the 'long' primitive data size, so the kernel explicitly encodes a 64-bit target memory region pointer when deployed on x86_64. FUSE driver enforce the _IOR-decoded payload envelope, hence it uses 8-byte buffer to accommodate the incoming user-space daemon response. When finalizing the ioctl transaction back down to user space, it writes all 8-bytes directly into the 4-bytes memory reference provided by e2fsprogs. Reproduce: compile with '-fstack-protector-strong' and '-D_FORTIFY_SOURCE=3' (fedor44, 7.2.5-200.fc44.x86_64): $ lsattr -v ./foo *** stack smashing detected ***: terminated Aborted (core dumped) lsattr -v ./foo Solution: change ioctl arg to 'long' but use only lower 32-bits of result. Signed-off-by: Shachar Sharon <synarete@gmail.com> --- lib/e2p/fgetversion.c | 4 ++-- lib/e2p/fsetversion.c | 7 ++++--- 2 files changed, 6 insertions(+), 5 deletions(-)