android/SukiSU-Ultra
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

kernel: throne_tracker: avoid cross-fs traversal using s_magic check

Browse Source 
Skip directories that does NOT have the same magic as /data/app.
This is to avoid scanning incfs and any other stacked filesystems.

While this is way dumber, it's way cheaper.
no kern_path(), no missable path_put(), no ref handling.

This is a workaround for Ultra-Legacy kernels where upstream's
method fails.

Seems doing 50+ kern_path() calls is a bad meme.

This supercedes `throne_tracker: avoid cross fs access (tiann#2626)`
- upstream 0b6998b474

Signed-off-by: backslashxx <118538522+backslashxx@users.noreply.github.com>
This commit is contained in:
backslashxx
2025-06-09 07:23:35 +08:00
committed by ShirkNeko
parent 99becea3a1
commit 0144a888da
1 changed files with 18 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
kernel/throne_tracker.c
View File

@@ -201,6 +201,8 @@ FILLDIR_RETURN_TYPE my_actor(struct dir_context *ctx, const char *name,
return FILLDIR_ACTOR_CONTINUE;
}
static unsigned long data_app_magic __read_mostly = 0; // its not like /data/app magic changes duh
void search_manager(const char *path, int depth, struct list_head *uid_data)
{
int i, stop = 0;
@@ -238,6 +240,22 @@ void search_manager(const char *path, int depth, struct list_head *uid_data)
pr_err("Failed to open directory: %s, err: %ld\n", pos->dirpath, PTR_ERR(file));
goto skip_iterate;
}
// grab magic on first folder, which is /data/app
if (unlikely(!data_app_magic)) {
if (file->f_inode->i_sb->s_magic) {
data_app_magic = file->f_inode->i_sb->s_magic;
pr_info("%s: dir: %s got magic! 0x%lx\n", __func__, pos->dirpath, data_app_magic);
} else
goto skip_iterate;
}
if (file->f_inode->i_sb->s_magic != data_app_magic) {
pr_info("%s: skip: %s magic: 0x%lx expected: 0x%lx\n", __func__, pos->dirpath,
file->f_inode->i_sb->s_magic, data_app_magic);
filp_close(file, NULL);
goto skip_iterate;
}
iterate_dir(file, &ctx.ctx);
filp_close(file, NULL);