Skip to content

Commit 0a5a024

Browse files
backslashxxShirkNeko
authored andcommitted
kernel: throne_tracker: avoid cross-fs traversal using s_magic check (tiann#2633)
Skip directories that does NOT have the same magic as /data/app. This is to avoid scanning incfs and any other stacked filesystems. While this is way dumber, it's way cheaper. no kern_path(), no missable path_put(), no ref handling. This supercedes `throne_tracker: avoid cross fs access (https://github.com/tiann/KernelSU/pull/2626)` - upstream tiann@0b6998b Signed-off-by: backslashxx <[email protected]>
1 parent b443b11 commit 0a5a024

File tree

1 file changed

+20
-1
lines changed

1 file changed

+20
-1
lines changed

kernel/throne_tracker.c

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -217,7 +217,8 @@ void search_manager(const char *path, int depth, struct list_head *uid_data)
217217
int i, stop = 0;
218218
struct list_head data_path_list;
219219
INIT_LIST_HEAD(&data_path_list);
220-
220+
unsigned long data_app_magic = 0;
221+
221222
// Initialize APK cache list
222223
struct apk_path_hash *pos, *n;
223224
list_for_each_entry(pos, &apk_path_hash_list, list) {
@@ -248,6 +249,24 @@ void search_manager(const char *path, int depth, struct list_head *uid_data)
248249
pr_err("Failed to open directory: %s, err: %ld\n", pos->dirpath, PTR_ERR(file));
249250
goto skip_iterate;
250251
}
252+
253+
// grab magic on first folder, which is /data/app
254+
if (!data_app_magic) {
255+
if (file->f_inode->i_sb->s_magic) {
256+
data_app_magic = file->f_inode->i_sb->s_magic;
257+
pr_info("%s: dir: %s got magic! 0x%lx\n", __func__, pos->dirpath, data_app_magic);
258+
} else {
259+
filp_close(file, NULL);
260+
goto skip_iterate;
261+
}
262+
}
263+
264+
if (file->f_inode->i_sb->s_magic != data_app_magic) {
265+
pr_info("%s: skip: %s magic: 0x%lx expected: 0x%lx\n", __func__, pos->dirpath,
266+
file->f_inode->i_sb->s_magic, data_app_magic);
267+
filp_close(file, NULL);
268+
goto skip_iterate;
269+
}
251270

252271
iterate_dir(file, &ctx.ctx);
253272
filp_close(file, NULL);

0 commit comments

Comments
 (0)