[PATCH v2] statx: don't leak STATX_ATTR_CHANGE_MONOTONIC in stx_attributes_mask

[PATCH v2] statx: don't leak STATX_ATTR_CHANGE_MONOTONIC in stx_attributes_mask

[Jeff Layton]

STATX_ATTR_CHANGE_MONOTONIC is kernel-internal. cp_statx() strips it
from stx_attributes but copies attributes_mask verbatim, so it leaks to
userland on filesystems that advertise it (nfs, ceph), e.g.
stx_attributes_mask = 0x8000000000303000 on NFS.

Add a new mask constant and apply it to both fields.

Fixes: a1175d6b1bda ("vfs: plumb i_version handling into struct kstat")
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
---
Changes in v2:
- Add new STATX_ATTR_INTERNAL_MASK constant
- Keep lines below 80 columns
- Link to v1: https://lore.kernel.org/r/20261029-statx-v1-1-9600cdb896b3@kernel.org
---
 fs/stat.c            | 6 +++---
 include/linux/stat.h | 3 +++
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/fs/stat.c b/fs/stat.c
index a2e63c6c45b7..34d786c1de3e 100644
--- a/fs/stat.c
+++ b/fs/stat.c
@@ -710,8 +710,7 @@ cp_statx(const struct kstat *stat, struct statx __user *buffer)
 	/* STATX_CHANGE_COOKIE is kernel-only for now */
 	tmp.stx_mask = stat->result_mask & ~STATX_CHANGE_COOKIE;
 	tmp.stx_blksize = stat->blksize;
-	/* STATX_ATTR_CHANGE_MONOTONIC is kernel-only for now */
-	tmp.stx_attributes = stat->attributes & ~STATX_ATTR_CHANGE_MONOTONIC;
+	tmp.stx_attributes = stat->attributes & ~STATX_ATTR_INTERNAL_MASK;
 	tmp.stx_nlink = stat->nlink;
 	tmp.stx_uid = from_kuid_munged(current_user_ns(), stat->uid);
 	tmp.stx_gid = from_kgid_munged(current_user_ns(), stat->gid);
@@ -719,7 +718,8 @@ cp_statx(const struct kstat *stat, struct statx __user *buffer)
 	tmp.stx_ino = stat->ino;
 	tmp.stx_size = stat->size;
 	tmp.stx_blocks = stat->blocks;
-	tmp.stx_attributes_mask = stat->attributes_mask;
+	tmp.stx_attributes_mask = stat->attributes_mask &
+				  ~STATX_ATTR_INTERNAL_MASK;
 	tmp.stx_atime.tv_sec = stat->atime.tv_sec;
 	tmp.stx_atime.tv_nsec = stat->atime.tv_nsec;
 	tmp.stx_btime.tv_sec = stat->btime.tv_sec;
diff --git a/include/linux/stat.h b/include/linux/stat.h
index 9c5709132862..4f0a4af7a067 100644
--- a/include/linux/stat.h
+++ b/include/linux/stat.h
@@ -69,4 +69,7 @@ struct kstat {
 /* file attribute values */
 #define STATX_ATTR_CHANGE_MONOTONIC	0x8000000000000000ULL /* version monotonically increases */
 
+/* mask of STATX_ATTR_* bits that is private to the kernel */
+#define STATX_ATTR_INTERNAL_MASK	(STATX_ATTR_CHANGE_MONOTONIC)
+
 #endif

---
base-commit: c339f4010dea8b0d754f84ace70cd1b089878ef8
change-id: 20261029-statx-3f1d8cd8d877

Best regards,
-- 
Jeff Layton <jlayton@kernel.org>

Re: [PATCH v2] statx: don't leak STATX_ATTR_CHANGE_MONOTONIC in stx_attributes_mask

[Christoph Hellwig]

On Tue, Nov 03, 2026 at 07:04:00AM -0500, Jeff Layton wrote:
> STATX_ATTR_CHANGE_MONOTONIC is kernel-internal. cp_statx() strips it
> from stx_attributes but copies attributes_mask verbatim, so it leaks to
> userland on filesystems that advertise it (nfs, ceph), e.g.
> stx_attributes_mask = 0x8000000000303000 on NFS.
> 
> Add a new mask constant and apply it to both fields.

Looks good:

Reviewed-by: Christoph Hellwig <hch@lst.de>

Re: [PATCH v2] statx: don't leak STATX_ATTR_CHANGE_MONOTONIC in stx_attributes_mask

[Christian Brauner]

On Tue, 03 Nov 2026 07:04:00 -0500, Jeff Layton wrote:
> STATX_ATTR_CHANGE_MONOTONIC is kernel-internal. cp_statx() strips it
> from stx_attributes but copies attributes_mask verbatim, so it leaks to
> userland on filesystems that advertise it (nfs, ceph), e.g.
> stx_attributes_mask = 0x8000000000303000 on NFS.
> 
> Add a new mask constant and apply it to both fields.
> 
> [...]

Applied to the vfs.fixes branch of the vfs/vfs.git tree.
Patches in the vfs.fixes branch should appear in linux-next soon.

Please report any outstanding bugs that were missed during review in a
new review to the original patch series allowing us to drop it.

It's encouraged to provide Acked-bys and Reviewed-bys even though the
patch has now been applied. If possible patch trailers will be updated.

Note that commit hashes shown below are subject to change due to rebase,
trailer updates or similar. If in doubt, please check the listed branch.

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git
branch: vfs.fixes

[1/1] statx: don't leak STATX_ATTR_CHANGE_MONOTONIC in stx_attributes_mask
      https://git.kernel.org/vfs/vfs/c/3cfb4bcbdaa4