[PATCH] VFS: Make filldir_t and struct kstat deal in 64-bit inode numbers

These patches make the kernel pass 64-bit inode numbers internally when
communicating to userspace, even on a 32-bit system.  They are required
because some filesystems have intrinsic 64-bit inode numbers: NFS3+ and XFS
for example.  The 64-bit inode numbers are then propagated to userspace
automatically where the arch supports it.

Problems have been seen with userspace (eg: ld.so) using the 64-bit inode
number returned by stat64() or getdents64() to differentiate files, and
failing because the 64-bit inode number space was compressed to 32-bits, and
so overlaps occur.

This patch:

Make filldir_t take a 64-bit inode number and struct kstat carry a 64-bit
inode number so that 64-bit inode numbers can be passed back to userspace.

The stat functions then returns the full 64-bit inode number where
available and where possible.  If it is not possible to represent the inode
number supplied by the filesystem in the field provided by userspace, then
error EOVERFLOW will be issued.

Similarly, the getdents/readdir functions now pass the full 64-bit inode
number to userspace where possible, returning EOVERFLOW instead when a
directory entry is encountered that can't be properly represented.

Note that this means that some inodes will not be stat'able on a 32-bit
system with old libraries where they were before - but it does mean that
there will be no ambiguity over what a 32-bit inode number refers to.

Note similarly that directory scans may be cut short with an error on a
32-bit system with old libraries where the scan would work before for the
same reasons.

It is judged unlikely that this situation will occur because modern glibc
uses 64-bit capable versions of stat and getdents class functions
exclusively, and that older systems are unlikely to encounter
unrepresentable inode numbers anyway.

[akpm: alpha build fix]
Signed-off-by: David Howells <dhowells@redhat.com>
Cc: Trond Myklebust <trond.myklebust@fys.uio.no>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

13 files changed, 110 insertions, 25 deletions

diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
index 8a31fc1bfb15..ad6173651995 100644
--- a/arch/alpha/kernel/osf_sys.c
+++ b/arch/alpha/kernel/osf_sys.c
@@ -111,22 +111,26 @@ struct osf_dirent_callback {
 
 static int
 osf_filldir(void *__buf, const char *name, int namlen, loff_t offset,
-            ino_t ino, unsigned int d_type)
+            u64 ino, unsigned int d_type)
 {
         struct osf_dirent __user *dirent;
         struct osf_dirent_callback *buf = (struct osf_dirent_callback *) __buf;
         unsigned int reclen = ROUND_UP(NAME_OFFSET + namlen + 1);
+        unsigned int d_ino;
 
         buf->error = -EINVAL;   /* only used if we fail */
         if (reclen > buf->count)
                 return -EINVAL;
+        d_ino = ino;
+        if (sizeof(d_ino) < sizeof(ino) && d_ino != ino)
+                return -EOVERFLOW;
         if (buf->basep) {
                 if (put_user(offset, buf->basep))
                         return -EFAULT;
                 buf->basep = NULL;
         }
         dirent = buf->dirent;
-        put_user(ino, &dirent->d_ino);
+        put_user(d_ino, &dirent->d_ino);
         put_user(namlen, &dirent->d_namlen);
         put_user(reclen, &dirent->d_reclen);
         if (copy_to_user(dirent->d_name, name, namlen) ||
diff --git a/arch/ia64/ia32/sys_ia32.c b/arch/ia64/ia32/sys_ia32.c
index bddbd22706ed..9d6a3f210148 100644
--- a/arch/ia64/ia32/sys_ia32.c
+++ b/arch/ia64/ia32/sys_ia32.c
@@ -125,6 +125,7 @@ sys32_execve (char __user *name, compat_uptr_t __user *argv, compat_uptr_t __use
 
 int cp_compat_stat(struct kstat *stat, struct compat_stat __user *ubuf)
 {
+        compat_ino_t ino;
         int err;
 
         if ((u64) stat->size > MAX_NON_LFS ||
@@ -132,11 +133,15 @@ int cp_compat_stat(struct kstat *stat, struct compat_stat __user *ubuf)
             !old_valid_dev(stat->rdev))
                 return -EOVERFLOW;
 
+        ino = stat->ino;
+        if (sizeof(ino) < sizeof(stat->ino) && ino != stat->ino)
+                return -EOVERFLOW;
+
         if (clear_user(ubuf, sizeof(*ubuf)))
                 return -EFAULT;
 
         err  = __put_user(old_encode_dev(stat->dev), &ubuf->st_dev);
-        err |= __put_user(stat->ino, &ubuf->st_ino);
+        err |= __put_user(ino, &ubuf->st_ino);
         err |= __put_user(stat->mode, &ubuf->st_mode);
         err |= __put_user(stat->nlink, &ubuf->st_nlink);
         err |= __put_user(high2lowuid(stat->uid), &ubuf->st_uid);
@@ -1222,16 +1227,20 @@ struct readdir32_callback {
 };
 
 static int
-filldir32 (void *__buf, const char *name, int namlen, loff_t offset, ino_t ino,
+filldir32 (void *__buf, const char *name, int namlen, loff_t offset, u64 ino,
            unsigned int d_type)
 {
         struct compat_dirent __user * dirent;
         struct getdents32_callback * buf = (struct getdents32_callback *) __buf;
         int reclen = ROUND_UP(offsetof(struct compat_dirent, d_name) + namlen + 1, 4);
+        u32 d_ino;
 
         buf->error = -EINVAL;   /* only used if we fail.. */
         if (reclen > buf->count)
                 return -EINVAL;
+        d_ino = ino;
+        if (sizeof(d_ino) < sizeof(ino) && d_ino != ino)
+                return -EOVERFLOW;
         buf->error = -EFAULT;   /* only used if we fail.. */
         dirent = buf->previous;
         if (dirent)
@@ -1239,7 +1248,7 @@ filldir32 (void *__buf, const char *name, int namlen, loff_t offset, ino_t ino,
                         return -EFAULT;
         dirent = buf->current_dir;
         buf->previous = dirent;
-        if (put_user(ino, &dirent->d_ino)
+        if (put_user(d_ino, &dirent->d_ino)
             || put_user(reclen, &dirent->d_reclen)
             || copy_to_user(dirent->d_name, name, namlen)
             || put_user(0, dirent->d_name + namlen))
@@ -1287,17 +1296,21 @@ out:
 }
 
 static int
-fillonedir32 (void * __buf, const char * name, int namlen, loff_t offset, ino_t ino,
+fillonedir32 (void * __buf, const char * name, int namlen, loff_t offset, u64 ino,
               unsigned int d_type)
 {
         struct readdir32_callback * buf = (struct readdir32_callback *) __buf;
         struct old_linux32_dirent __user * dirent;
+        u32 d_ino;
 
         if (buf->count)
                 return -EINVAL;
+        d_ino = ino;
+        if (sizeof(d_ino) < sizeof(ino) && d_ino != ino)
+                return -EOVERFLOW;
         buf->count++;
         dirent = buf->dirent;
-        if (put_user(ino, &dirent->d_ino)
+        if (put_user(d_ino, &dirent->d_ino)
             || put_user(offset, &dirent->d_offset)
             || put_user(namlen, &dirent->d_namlen)
             || copy_to_user(dirent->d_name, name, namlen)
diff --git a/arch/mips/kernel/linux32.c b/arch/mips/kernel/linux32.c
index 52cada45b353..53f4171fc188 100644
--- a/arch/mips/kernel/linux32.c
+++ b/arch/mips/kernel/linux32.c
@@ -77,6 +77,8 @@ int cp_compat_stat(struct kstat *stat, struct compat_stat __user *statbuf)
         memset(&tmp, 0, sizeof(tmp));
         tmp.st_dev = new_encode_dev(stat->dev);
         tmp.st_ino = stat->ino;
+        if (sizeof(tmp.st_ino) < sizeof(stat->ino) && tmp.st_ino != stat->ino)
+                return -EOVERFLOW;
         tmp.st_mode = stat->mode;
         tmp.st_nlink = stat->nlink;
         SET_UID(tmp.st_uid, stat->uid);
diff --git a/arch/mips/kernel/sysirix.c b/arch/mips/kernel/sysirix.c
index 11bb97174972..93c74fefff76 100644
--- a/arch/mips/kernel/sysirix.c
+++ b/arch/mips/kernel/sysirix.c
@@ -1739,12 +1739,13 @@ struct irix_dirent32_callback {
 #define ROUND_UP32(x) (((x)+sizeof(u32)-1) & ~(sizeof(u32)-1))
 
 static int irix_filldir32(void *__buf, const char *name,
-        int namlen, loff_t offset, ino_t ino, unsigned int d_type)
+        int namlen, loff_t offset, u64 ino, unsigned int d_type)
 {
         struct irix_dirent32 __user *dirent;
         struct irix_dirent32_callback *buf = __buf;
         unsigned short reclen = ROUND_UP32(NAME_OFFSET32(dirent) + namlen + 1);
         int err = 0;
+        u32 d_ino;
 
 #ifdef DEBUG_GETDENTS
         printk("\nirix_filldir32[reclen<%d>namlen<%d>count<%d>]",
@@ -1753,12 +1754,15 @@ static int irix_filldir32(void *__buf, const char *name,
         buf->error = -EINVAL;   /* only used if we fail.. */
         if (reclen > buf->count)
                 return -EINVAL;
+        d_ino = ino;
+        if (sizeof(d_ino) < sizeof(ino) && d_ino != ino)
+                return -EOVERFLOW;
         dirent = buf->previous;
         if (dirent)
                 err = __put_user(offset, &dirent->d_off);
         dirent = buf->current_dir;
         err |= __put_user(dirent, &buf->previous);
-        err |= __put_user(ino, &dirent->d_ino);
+        err |= __put_user(d_ino, &dirent->d_ino);
         err |= __put_user(reclen, &dirent->d_reclen);
         err |= copy_to_user((char __user *)dirent->d_name, name, namlen) ? -EFAULT : 0;
         err |= __put_user(0, &dirent->d_name[namlen]);
@@ -1837,7 +1841,7 @@ struct irix_dirent64_callback {
 #define ROUND_UP64(x) (((x)+sizeof(u64)-1) & ~(sizeof(u64)-1))
 
 static int irix_filldir64(void *__buf, const char *name,
-        int namlen, loff_t offset, ino_t ino, unsigned int d_type)
+        int namlen, loff_t offset, u64 ino, unsigned int d_type)
 {
         struct irix_dirent64 __user *dirent;
         struct irix_dirent64_callback * buf = __buf;
diff --git a/arch/parisc/hpux/fs.c b/arch/parisc/hpux/fs.c
index d7c80edf4489..6e79dbf3f6bd 100644
--- a/arch/parisc/hpux/fs.c
+++ b/arch/parisc/hpux/fs.c
@@ -77,17 +77,21 @@ static int filldir(void * __buf, const char * name, int namlen, loff_t offset,
 {
         struct hpux_dirent * dirent;
         struct getdents_callback * buf = (struct getdents_callback *) __buf;
+        ino_t d_ino;
         int reclen = ROUND_UP(NAME_OFFSET(dirent) + namlen + 1);
 
         buf->error = -EINVAL;   /* only used if we fail.. */
         if (reclen > buf->count)
                 return -EINVAL;
+        d_ino = ino;
+        if (sizeof(d_ino) < sizeof(ino) && d_ino != ino)
+                return -EOVERFLOW;
         dirent = buf->previous;
         if (dirent)
                 put_user(offset, &dirent->d_off);
         dirent = buf->current_dir;
         buf->previous = dirent;
-        put_user(ino, &dirent->d_ino);
+        put_user(d_ino, &dirent->d_ino);
         put_user(reclen, &dirent->d_reclen);
         put_user(namlen, &dirent->d_namlen);
         copy_to_user(dirent->d_name, name, namlen);
diff --git a/arch/parisc/kernel/sys_parisc32.c b/arch/parisc/kernel/sys_parisc32.c
index b74869803081..e3b30bc36453 100644
--- a/arch/parisc/kernel/sys_parisc32.c
+++ b/arch/parisc/kernel/sys_parisc32.c
@@ -237,14 +237,19 @@ int sys32_settimeofday(struct compat_timeval __user *tv, struct timezone __user
 
 int cp_compat_stat(struct kstat *stat, struct compat_stat __user *statbuf)
 {
+        compat_ino_t ino;
         int err;
 
         if (stat->size > MAX_NON_LFS || !new_valid_dev(stat->dev) ||
             !new_valid_dev(stat->rdev))
                 return -EOVERFLOW;
 
+        ino = stat->ino;
+        if (sizeof(ino) < sizeof(stat->ino) && ino != stat->ino)
+                return -EOVERFLOW;
+
         err  = put_user(new_encode_dev(stat->dev), &statbuf->st_dev);
-        err |= put_user(stat->ino, &statbuf->st_ino);
+        err |= put_user(ino, &statbuf->st_ino);
         err |= put_user(stat->mode, &statbuf->st_mode);
         err |= put_user(stat->nlink, &statbuf->st_nlink);
         err |= put_user(0, &statbuf->st_reserved1);
@@ -312,16 +317,20 @@ filldir32 (void *__buf, const char *name, int namlen, loff_t offset, ino_t ino,
         struct linux32_dirent __user * dirent;
         struct getdents32_callback * buf = (struct getdents32_callback *) __buf;
         int reclen = ROUND_UP(NAME_OFFSET(dirent) + namlen + 1, 4);
+        u32 d_ino;
 
         buf->error = -EINVAL;   /* only used if we fail.. */
         if (reclen > buf->count)
                 return -EINVAL;
+        d_ino = ino;
+        if (sizeof(d_ino) < sizeof(ino) && d_ino != ino)
+                return -EOVERFLOW;
         dirent = buf->previous;
         if (dirent)
                 put_user(offset, &dirent->d_off);
         dirent = buf->current_dir;
         buf->previous = dirent;
-        put_user(ino, &dirent->d_ino);
+        put_user(d_ino, &dirent->d_ino);
         put_user(reclen, &dirent->d_reclen);
         copy_to_user(dirent->d_name, name, namlen);
         put_user(0, dirent->d_name + namlen);
@@ -371,12 +380,16 @@ fillonedir32 (void * __buf, const char * name, int namlen, loff_t offset, ino_t
 {
         struct readdir32_callback * buf = (struct readdir32_callback *) __buf;
         struct old_linux32_dirent __user * dirent;
+        u32 d_ino;
 
         if (buf->count)
                 return -EINVAL;
+        d_ino = ino;
+        if (sizeof(d_ino) < sizeof(ino) && d_ino != ino)
+                return -EOVERFLOW;
         buf->count++;
         dirent = buf->dirent;
-        put_user(ino, &dirent->d_ino);
+        put_user(d_ino, &dirent->d_ino);
         put_user(offset, &dirent->d_offset);
         put_user(namlen, &dirent->d_namlen);
         copy_to_user(dirent->d_name, name, namlen);
diff --git a/arch/powerpc/kernel/sys_ppc32.c b/arch/powerpc/kernel/sys_ppc32.c
index 5e391fc25340..d15c33e95959 100644
--- a/arch/powerpc/kernel/sys_ppc32.c
+++ b/arch/powerpc/kernel/sys_ppc32.c
@@ -69,16 +69,20 @@ struct readdir_callback32 {
 };
 
 static int fillonedir(void * __buf, const char * name, int namlen,
-                                  off_t offset, ino_t ino, unsigned int d_type)
+                                  off_t offset, u64 ino, unsigned int d_type)
 {
         struct readdir_callback32 * buf = (struct readdir_callback32 *) __buf;
         struct old_linux_dirent32 __user * dirent;
+        ino_t d_ino;
 
         if (buf->count)
                 return -EINVAL;
+        d_ino = ino;
+        if (sizeof(d_ino) < sizeof(ino) && d_ino != ino)
+                return -EOVERFLOW;
         buf->count++;
         dirent = buf->dirent;
-        put_user(ino, &dirent->d_ino);
+        put_user(d_ino, &dirent->d_ino);
         put_user(offset, &dirent->d_offset);
         put_user(namlen, &dirent->d_namlen);
         copy_to_user(dirent->d_name, name, namlen);
@@ -120,15 +124,20 @@ asmlinkage long ppc32_select(u32 n, compat_ulong_t __user *inp,
 
 int cp_compat_stat(struct kstat *stat, struct compat_stat __user *statbuf)
 {
+        compat_ino_t ino;
         long err;
 
         if (stat->size > MAX_NON_LFS || !new_valid_dev(stat->dev) ||
             !new_valid_dev(stat->rdev))
                 return -EOVERFLOW;
 
+        ino = stat->ino;
+        if (sizeof(ino) < sizeof(stat->ino) && ino != stat->ino)
+                return -EOVERFLOW;
+
         err  = access_ok(VERIFY_WRITE, statbuf, sizeof(*statbuf)) ? 0 : -EFAULT;
         err |= __put_user(new_encode_dev(stat->dev), &statbuf->st_dev);
-        err |= __put_user(stat->ino, &statbuf->st_ino);
+        err |= __put_user(ino, &statbuf->st_ino);
         err |= __put_user(stat->mode, &statbuf->st_mode);
         err |= __put_user(stat->nlink, &statbuf->st_nlink);
         err |= __put_user(stat->uid, &statbuf->st_uid);
diff --git a/arch/s390/kernel/compat_linux.c b/arch/s390/kernel/compat_linux.c
index c46e3d48e410..e15e1489aef5 100644
--- a/arch/s390/kernel/compat_linux.c
+++ b/arch/s390/kernel/compat_linux.c
@@ -357,11 +357,16 @@ asmlinkage long sys32_ftruncate64(unsigned int fd, unsigned long high, unsigned
 
 int cp_compat_stat(struct kstat *stat, struct compat_stat __user *statbuf)
 {
+        compat_ino_t ino;
         int err;
 
         if (!old_valid_dev(stat->dev) || !old_valid_dev(stat->rdev))
                 return -EOVERFLOW;
 
+        ino = stat->ino;
+        if (sizeof(ino) < sizeof(stat->ino) && ino != stat->ino)
+                return -EOVERFLOW;
+
         err = put_user(old_encode_dev(stat->dev), &statbuf->st_dev);
         err |= put_user(stat->ino, &statbuf->st_ino);
         err |= put_user(stat->mode, &statbuf->st_mode);
diff --git a/arch/sparc/kernel/sys_sunos.c b/arch/sparc/kernel/sys_sunos.c
index 9d2cd97d1c3a..6f3ac548ee66 100644
--- a/arch/sparc/kernel/sys_sunos.c
+++ b/arch/sparc/kernel/sys_sunos.c
@@ -325,21 +325,25 @@ struct sunos_dirent_callback {
 #define ROUND_UP(x) (((x)+sizeof(long)-1) & ~(sizeof(long)-1))
 
 static int sunos_filldir(void * __buf, const char * name, int namlen,
-                         loff_t offset, ino_t ino, unsigned int d_type)
+                         loff_t offset, u64 ino, unsigned int d_type)
 {
         struct sunos_dirent __user *dirent;
         struct sunos_dirent_callback * buf = __buf;
+        unsigned long d_ino;
         int reclen = ROUND_UP(NAME_OFFSET(dirent) + namlen + 1);
 
         buf->error = -EINVAL;   /* only used if we fail.. */
         if (reclen > buf->count)
                 return -EINVAL;
+        d_ino = ino;
+        if (sizeof(d_ino) < sizeof(ino) && d_ino != ino)
+                return -EOVERFLOW;
         dirent = buf->previous;
         if (dirent)
                 put_user(offset, &dirent->d_off);
         dirent = buf->curr;
         buf->previous = dirent;
-        put_user(ino, &dirent->d_ino);
+        put_user(d_ino, &dirent->d_ino);
         put_user(namlen, &dirent->d_namlen);
         put_user(reclen, &dirent->d_reclen);
         copy_to_user(dirent->d_name, name, namlen);
@@ -406,19 +410,23 @@ struct sunos_direntry_callback {
 };
 
 static int sunos_filldirentry(void * __buf, const char * name, int namlen,
-                              loff_t offset, ino_t ino, unsigned int d_type)
+                              loff_t offset, u64 ino, unsigned int d_type)
 {
         struct sunos_direntry __user *dirent;
         struct sunos_direntry_callback *buf = __buf;
+        unsigned long d_ino;
         int reclen = ROUND_UP(NAME_OFFSET(dirent) + namlen + 1);
 
         buf->error = -EINVAL;   /* only used if we fail.. */
         if (reclen > buf->count)
                 return -EINVAL;
+        d_ino = ino;
+        if (sizeof(d_ino) < sizeof(ino) && d_ino != ino)
+                return -EOVERFLOW;
         dirent = buf->previous;
         dirent = buf->curr;
         buf->previous = dirent;
-        put_user(ino, &dirent->d_ino);
+        put_user(d_ino, &dirent->d_ino);
         put_user(namlen, &dirent->d_namlen);
         put_user(reclen, &dirent->d_reclen);
         copy_to_user(dirent->d_name, name, namlen);
diff --git a/arch/sparc64/kernel/sys_sparc32.c b/arch/sparc64/kernel/sys_sparc32.c
index 69444f266e2d..dbc6d1a3be1f 100644
--- a/arch/sparc64/kernel/sys_sparc32.c
+++ b/arch/sparc64/kernel/sys_sparc32.c
@@ -337,12 +337,17 @@ asmlinkage long sys32_ftruncate64(unsigned int fd, unsigned long high, unsigned
 
 int cp_compat_stat(struct kstat *stat, struct compat_stat __user *statbuf)
 {
+        compat_ino_t ino;
         int err;
 
         if (stat->size > MAX_NON_LFS || !old_valid_dev(stat->dev) ||
             !old_valid_dev(stat->rdev))
                 return -EOVERFLOW;
 
+        ino = stat->ino;
+        if (sizeof(ino) < sizeof(stat->ino) && ino != stat->ino)
+                return -EOVERFLOW;
+
         err  = put_user(old_encode_dev(stat->dev), &statbuf->st_dev);
         err |= put_user(stat->ino, &statbuf->st_ino);
         err |= put_user(stat->mode, &statbuf->st_mode);
diff --git a/arch/sparc64/kernel/sys_sunos32.c b/arch/sparc64/kernel/sys_sunos32.c
index 953296b73f3f..e414c8ef0225 100644
--- a/arch/sparc64/kernel/sys_sunos32.c
+++ b/arch/sparc64/kernel/sys_sunos32.c
@@ -280,16 +280,20 @@ static int sunos_filldir(void * __buf, const char * name, int namlen,
         struct sunos_dirent __user *dirent;
         struct sunos_dirent_callback * buf = (struct sunos_dirent_callback *) __buf;
         int reclen = ROUND_UP(NAME_OFFSET(dirent) + namlen + 1);
+        u32 d_ino;
 
         buf->error = -EINVAL;   /* only used if we fail.. */
         if (reclen > buf->count)
                 return -EINVAL;
+        d_ino = ino;
+        if (sizeof(d_ino) < sizeof(ino) && d_ino != ino)
+                return -EOVERFLOW;
         dirent = buf->previous;
         if (dirent)
                 put_user(offset, &dirent->d_off);
         dirent = buf->curr;
         buf->previous = dirent;
-        put_user(ino, &dirent->d_ino);
+        put_user(d_ino, &dirent->d_ino);
         put_user(namlen, &dirent->d_namlen);
         put_user(reclen, &dirent->d_reclen);
         if (copy_to_user(dirent->d_name, name, namlen))
@@ -363,14 +367,18 @@ static int sunos_filldirentry(void * __buf, const char * name, int namlen,
         struct sunos_direntry_callback * buf =
                 (struct sunos_direntry_callback *) __buf;
         int reclen = ROUND_UP(NAME_OFFSET(dirent) + namlen + 1);
+        u32 d_ino;
 
         buf->error = -EINVAL;   /* only used if we fail.. */
         if (reclen > buf->count)
                 return -EINVAL;
+        d_ino = ino;
+        if (sizeof(d_ino) < sizeof(ino) && d_ino != ino)
+                return -EOVERFLOW;
         dirent = buf->previous;
         dirent = buf->curr;
         buf->previous = dirent;
-        put_user(ino, &dirent->d_ino);
+        put_user(d_ino, &dirent->d_ino);
         put_user(namlen, &dirent->d_namlen);
         put_user(reclen, &dirent->d_reclen);
         if (copy_to_user(dirent->d_name, name, namlen))
diff --git a/arch/sparc64/solaris/fs.c b/arch/sparc64/solaris/fs.c
index 0f0eb6aa1c40..12a940cc791f 100644
--- a/arch/sparc64/solaris/fs.c
+++ b/arch/sparc64/solaris/fs.c
@@ -82,12 +82,17 @@ struct sol_stat64 {
 
 static inline int putstat(struct sol_stat __user *ubuf, struct kstat *kbuf)
 {
+        u32 ino;
+
         if (kbuf->size > MAX_NON_LFS ||
             !sysv_valid_dev(kbuf->dev) ||
             !sysv_valid_dev(kbuf->rdev))
                 return -EOVERFLOW;
+        ino = kbuf->ino;
+        if (sizeof(ino) < sizeof(kbuf->ino) && ino != kbuf->ino)
+                return -EOVERFLOW;
         if (put_user (sysv_encode_dev(kbuf->dev), &ubuf->st_dev)        ||
-            __put_user (kbuf->ino, &ubuf->st_ino)               ||
+            __put_user (ino, &ubuf->st_ino)                             ||
             __put_user (kbuf->mode, &ubuf->st_mode)             ||
             __put_user (kbuf->nlink, &ubuf->st_nlink)   ||
             __put_user (kbuf->uid, &ubuf->st_uid)               ||
diff --git a/arch/x86_64/ia32/sys_ia32.c b/arch/x86_64/ia32/sys_ia32.c
index 26a01717cc1a..c9bac3af29d6 100644
--- a/arch/x86_64/ia32/sys_ia32.c
+++ b/arch/x86_64/ia32/sys_ia32.c
@@ -76,6 +76,8 @@
 
 int cp_compat_stat(struct kstat *kbuf, struct compat_stat __user *ubuf)
 {
+        compat_ino_t ino;
+
         typeof(ubuf->st_uid) uid = 0;
         typeof(ubuf->st_gid) gid = 0;
         SET_UID(uid, kbuf->uid);
@@ -84,9 +86,12 @@ int cp_compat_stat(struct kstat *kbuf, struct compat_stat __user *ubuf)
                 return -EOVERFLOW;
         if (kbuf->size >= 0x7fffffff)
                 return -EOVERFLOW;
+        ino = kbuf->ino;
+        if (sizeof(ino) < sizeof(kbuf->ino) && ino != kbuf->ino)
+                return -EOVERFLOW;
         if (!access_ok(VERIFY_WRITE, ubuf, sizeof(struct compat_stat)) ||
             __put_user (old_encode_dev(kbuf->dev), &ubuf->st_dev) ||
-            __put_user (kbuf->ino, &ubuf->st_ino) ||
+            __put_user (ino, &ubuf->st_ino) ||
             __put_user (kbuf->mode, &ubuf->st_mode) ||
             __put_user (kbuf->nlink, &ubuf->st_nlink) ||
             __put_user (uid, &ubuf->st_uid) ||