Skip to content

Commit 82f7e2c

Browse files
committed
throne_tracker: avoid cross-fs traversal using s_magic check
Skip directories in /data/app that are NOT the same as /data/app. This is to avoid scanning incfs and any other stacked filesystems. This is a simple workaround for Ultra-Legacy kernels where upstream's method fails. Replaces: `throne_tracker: avoid cross fs access` tiann/KernelSU#2626 Signed-off-by: backslashxx <[email protected]>
1 parent cf9b930 commit 82f7e2c

File tree

1 file changed

+29
-1
lines changed

1 file changed

+29
-1
lines changed

drivers/kernelsu/throne_tracker.c

Lines changed: 29 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -225,13 +225,19 @@ void search_manager(const char *path, int depth, struct list_head *uid_data)
225225
int i, stop = 0;
226226
struct list_head data_path_list;
227227
INIT_LIST_HEAD(&data_path_list);
228+
unsigned long *data_app_magic;
229+
bool got_magic = false;
228230

229231
// Initialize APK cache list
230232
struct apk_path_hash *pos, *n;
231233
list_for_each_entry(pos, &apk_path_hash_list, list) {
232234
pos->exists = false;
233235
}
234236

237+
data_app_magic = kmalloc(sizeof(unsigned long), GFP_ATOMIC); // they use atomic here so
238+
if (!data_app_magic) // just be defensive
239+
goto skip_iterate;
240+
235241
// First depth
236242
struct data_path data;
237243
#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 8, 0)
@@ -271,7 +277,26 @@ void search_manager(const char *path, int depth, struct list_head *uid_data)
271277
pr_err("Failed to open directory: %s, err: %ld\n", pos->dirpath, PTR_ERR(file));
272278
goto skip_iterate;
273279
}
274-
280+
281+
// grab magic on first folder, which is /data/app
282+
if (!got_magic) {
283+
if (file->f_inode->i_sb->s_magic) {
284+
*data_app_magic = file->f_inode->i_sb->s_magic;
285+
got_magic = true;
286+
} else
287+
goto skip_iterate;
288+
}
289+
290+
if (file->f_inode->i_sb->s_magic && file->f_inode->i_sb->s_magic != *data_app_magic) {
291+
pr_info("%s: skip: %s magic: %lx expected: %lx\n", pos->dirpath,
292+
file->f_inode->i_sb->s_magic, *data_app_magic);
293+
filp_close(file, NULL);
294+
goto skip_iterate;
295+
}
296+
#ifdef CONFIG_KSU_DEBUG
297+
if (file->f_inode->i_sb->s_magic)
298+
pr_info("%s: current dir: %s magic: %lx expected: %lx\n", __func__, pos->dirpath, file->f_inode->i_sb->s_magic, *data_app_magic);
299+
#endif
275300
iterate_dir(file, &ctx.ctx);
276301
filp_close(file, NULL);
277302
}
@@ -282,6 +307,9 @@ void search_manager(const char *path, int depth, struct list_head *uid_data)
282307
}
283308
}
284309

310+
if (data_app_magic)
311+
kfree(data_app_magic);
312+
285313
// Remove stale cached APK entries
286314
list_for_each_entry_safe(pos, n, &apk_path_hash_list, list) {
287315
if (!pos->exists) {

0 commit comments

Comments
 (0)