Skip to content

Commit d500b0d

Browse files
committed
kernel: throne_tracker: avoid cross-fs traversal using s_magic check
Skip directories that does NOT have the same magic as /data/app. This is to avoid scanning incfs and any other stacked filesystems. While this is way dumber, it's way cheaper. no kern_path(), no missable path_put(), no ref handling. This supercedes `throne_tracker: avoid cross fs access (https://github.com/tiann/KernelSU/pull/2626)` - upstream 0b6998b Signed-off-by: backslashxx <[email protected]>
1 parent acec737 commit d500b0d

File tree

1 file changed

+18
-1
lines changed

1 file changed

+18
-1
lines changed

kernel/throne_tracker.c

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -213,7 +213,8 @@ void search_manager(const char *path, int depth, struct list_head *uid_data)
213213
int i, stop = 0;
214214
struct list_head data_path_list;
215215
INIT_LIST_HEAD(&data_path_list);
216-
216+
static unsigned long data_app_magic __read_mostly = 0;
217+
217218
// Initialize APK cache list
218219
struct apk_path_hash *pos, *n;
219220
list_for_each_entry(pos, &apk_path_hash_list, list) {
@@ -244,6 +245,22 @@ void search_manager(const char *path, int depth, struct list_head *uid_data)
244245
pr_err("Failed to open directory: %s, err: %ld\n", pos->dirpath, PTR_ERR(file));
245246
goto skip_iterate;
246247
}
248+
249+
// grab magic on first folder, which is /data/app
250+
if (unlikely(!data_app_magic)) {
251+
if (file->f_inode->i_sb->s_magic) {
252+
data_app_magic = file->f_inode->i_sb->s_magic;
253+
pr_info("%s: dir: %s got magic! 0x%lx\n", __func__, pos->dirpath, data_app_magic);
254+
} else
255+
goto skip_iterate;
256+
}
257+
258+
if (file->f_inode->i_sb->s_magic != data_app_magic) {
259+
pr_info("%s: skip: %s magic: 0x%lx expected: 0x%lx\n", __func__, pos->dirpath,
260+
file->f_inode->i_sb->s_magic, data_app_magic);
261+
filp_close(file, NULL);
262+
goto skip_iterate;
263+
}
247264

248265
iterate_dir(file, &ctx.ctx);
249266
filp_close(file, NULL);

0 commit comments

Comments
 (0)