13 files changed, 110 insertions, 25 deletions

diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
index 8a31fc1bfb15..ad6173651995 100644
--- a/arch/alpha/kernel/osf_sys.c
+++ b/arch/alpha/kernel/osf_sys.c
@@ -111,22 +111,26 @@ struct osf_dirent_callback {
 
 static int
 osf_filldir(void *__buf, const char *name, int namlen, loff_t offset,
-            ino_t ino, unsigned int d_type)
+            u64 ino, unsigned int d_type)
 {
         struct osf_dirent __user *dirent;
         struct osf_dirent_callback *buf = (struct osf_dirent_callback *) __buf;
         unsigned int reclen = ROUND_UP(NAME_OFFSET + namlen + 1);
+        unsigned int d_ino;
 
         buf->error = -EINVAL;   /* only used if we fail */
         if (reclen > buf->count)
                 return -EINVAL;
+        d_ino = ino;
+        if (sizeof(d_ino) < sizeof(ino) && d_ino != ino)
+                return -EOVERFLOW;
         if (buf->basep) {
                 if (put_user(offset, buf->basep))
                         return -EFAULT;
                 buf->basep = NULL;
         }
         dirent = buf->dirent;
-        put_user(ino, &dirent->d_ino);
+        put_user(d_ino, &dirent->d_ino);
         put_user(namlen, &dirent->d_namlen);
         put_user(reclen, &dirent->d_reclen);
         if (copy_to_user(dirent->d_name, name, namlen) ||
diff --git a/arch/ia64/ia32/sys_ia32.c b/arch/ia64/ia32/sys_ia32.c
index bddbd22706ed..9d6a3f210148 100644
--- a/arch/ia64/ia32/sys_ia32.c
+++ b/arch/ia64/ia32/sys_ia32.c
@@ -125,6 +125,7 @@ sys32_execve (char __user *name, compat_uptr_t __user *argv, compat_uptr_t __use
 
 int cp_compat_stat(struct kstat *stat, struct compat_stat __user *ubuf)
 {
+        compat_ino_t ino;
         int err;
 
         if ((u64) stat->size > MAX_NON_LFS ||
@@ -132,11 +133,15 @@ int cp_compat_stat(struct kstat *stat, struct compat_stat __user *ubuf)
             !old_valid_dev(stat->rdev))
                 return -EOVERFLOW;
 
+        ino = stat->ino;
+        if (sizeof(ino) < sizeof(stat->ino) && ino != stat->ino)
+                return -EOVERFLOW;
+
         if (clear_user(ubuf, sizeof(*ubuf)))
                 return -EFAULT;
 
         err  = __put_user(old_encode_dev(stat->dev), &ubuf->st_dev);
-        err |= __put_user(stat->ino, &ubuf->st_ino);
+        err |= __put_user(ino, &ubuf->st_ino);
         err |= __put_user(stat->mode, &ubuf->st_mode);
         err |= __put_user(stat->nlink, &ubuf->st_nlink);
         err |= __put_user(high2lowuid(stat->uid), &ubuf->st_uid);
@@ -1222,16 +1227,20 @@ struct readdir32_callback {
 };
 
 static int
-filldir32 (void *__buf, const char *name, int namlen, loff_t offset, ino_t ino,
+filldir32 (void *__buf, const char *name, int namlen, loff_t offset, u64 ino,
            unsigned int d_type)
 {
         struct compat_dirent __user * dirent;
         struct getdents32_callback * buf = (struct getdents32_callback *) __buf;
         int reclen = ROUND_UP(offsetof(struct compat_dirent, d_name) + namlen + 1, 4);
+        u32 d_ino;
 
         buf->error = -EINVAL;   /* only used if we fail.. */
         if (reclen > buf->count)
                 return -EINVAL;
+        d_ino = ino;
+        if (sizeof(d_ino) < sizeof(ino) && d_ino != ino)
+                return -EOVERFLOW;
         buf->error = -EFAULT;   /* only used if we fail.. */
         dirent = buf->previous;
         if (dirent)
@@ -1239,7 +1248,7 @@ filldir32 (void *__buf, const char *name, int namlen, loff_t offset, ino_t ino,
                         return -EFAULT;
         dirent = buf->current_dir;
         buf->previous = dirent;
-        if (put_user(ino, &dirent->d_ino)
+        if (put_user(d_ino, &dirent->d_ino)
             || put_user(reclen, &dirent->d_reclen)
             || copy_to_user(dirent->d_name, name, namlen)
             || put_user(0, dirent->d_name + namlen))
@@ -1287,17 +1296,21 @@ out:
 }
 
 static int
-fillonedir32 (void * __buf, const char * name, int namlen, loff_t offset, ino_t ino,
+fillonedir32 (void * __buf, const char * name, int namlen, loff_t offset, u64 ino,
               unsigned int d_type)
 {
         struct readdir32_callback * buf = (struct readdir32_callback *) __buf;
         struct old_linux32_dirent __user * dirent;
+        u32 d_ino;
 
         if (buf->count)
                 return -EINVAL;
+        d_ino = ino;
+        if (sizeof(d_ino) < sizeof(ino) && d_ino != ino)
+                return -EOVERFLOW;
         buf->count++;
         dirent = buf->dirent;
-        if (put_user(ino, &dirent->d_ino)
+        if (put_user(d_ino, &dirent->d_ino)
             || put_user(offset, &dirent->d_offset)
             || put_user(namlen, &dirent->d_namlen)
             || copy_to_user(dirent->d_name, name, namlen)
diff --git a/arch/mips/kernel/linux32.c b/arch/mips/kernel/linux32.c
index 52cada45b353..53f4171fc188 100644
--- a/arch/mips/kernel/linux32.c
+++ b/arch/mips/kernel/linux32.c
@@ -77,6 +77,8 @@ int cp_compat_stat(struct kstat *stat, struct compat_stat __user *statbuf)
         memset(&tmp, 0, sizeof(tmp));
         tmp.st_dev = new_encode_dev(stat->dev);
         tmp.st_ino = stat->ino;
+        if (sizeof(tmp.st_ino) < sizeof(stat->ino) && tmp.st_ino != stat->ino)
+                return -EOVERFLOW;
         tmp.st_mode = stat->mode;
         tmp.st_nlink = stat->nlink;
         SET_UID(tmp.st_uid, stat->uid);
diff --git a/arch/mips/kernel/sysirix.c b/arch/mips/kernel/sysirix.c
index 11bb97174972..93c74fefff76 100644
--- a/arch/mips/kernel/sysirix.c
+++ b/arch/mips/kernel/sysirix.c
@@ -1739,12 +1739,13 @@ struct irix_dirent32_callback {
 #define ROUND_UP32(x) (((x)+sizeof(u32)-1) & ~(sizeof(u32)-1))
 
 static int irix_filldir32(void *__buf, const char *name,
-        int namlen, loff_t offset, ino_t ino, unsigned int d_type)
+        int namlen, loff_t offset, u64 ino, unsigned int d_type)
 {
         struct irix_dirent32 __user *dirent;
         struct irix_dirent32_callback *buf = __buf;
         unsigned short reclen = ROUND_UP32(NAME_OFFSET32(dirent) + namlen + 1);
         int err = 0;
+        u32 d_ino;
 
 #ifdef DEBUG_GETDENTS
         printk("\nirix_filldir32[reclen<%d>namlen<%d>count<%d>]",
@@ -1753,12 +1754,15 @@ static int irix_filldir32(void *__buf, const char *name,
         buf->error = -EINVAL;   /* only used if we fail.. */
         if (reclen > buf->count)
                 return -EINVAL;
+        d_ino = ino;
+        if (sizeof(d_ino) < sizeof(ino) && d_ino != ino)
+                return -EOVERFLOW;
         dirent = buf->previous;
         if (dirent)
                 err = __put_user(offset, &dirent->d_off);
         dirent = buf->current_dir;
         err |= __put_user(dirent, &buf->previous);
-        err |= __put_user(ino, &dirent->d_ino);
+        err |= __put_user(d_ino, &dirent->d_ino);
         err |= __put_user(reclen, &dirent->d_reclen);
         err |= copy_to_user((char __user *)dirent->d_name, name, namlen) ? -EFAULT : 0;
         err |= __put_user(0, &dirent->d_name[namlen]);
@@ -1837,7 +1841,7 @@ struct irix_dirent64_callback {
 #define ROUND_UP64(x) (((x)+sizeof(u64)-1) & ~(sizeof(u64)-1))
 
 static int irix_filldir64(void *__buf, const char *name,
-        int namlen, loff_t offset, ino_t ino, unsigned int d_type)
+        int namlen, loff_t offset, u64 ino, unsigned int d_type)
 {
         struct irix_dirent64 __user *dirent;
         struct irix_dirent64_callback * buf = __buf;
diff --git a/arch/parisc/hpux/fs.c b/arch/parisc/hpux/fs.c
index d7c80edf4489..6e79dbf3f6bd 100644
--- a/arch/parisc/hpux/fs.c
+++ b/arch/parisc/hpux/fs.c
@@ -77,17 +77,21 @@ static int filldir(void * __buf, const char * name, int namlen, loff_t offset,
 {
         struct hpux_dirent * dirent;
         struct getdents_callback * buf = (struct getdents_callback *) __buf;
+        ino_t d_ino;
         int reclen = ROUND_UP(NAME_OFFSET(dirent) + namlen + 1);
 
         buf->error = -EINVAL;   /* only used if we fail.. */
         if (reclen > buf->count)
                 return -EINVAL;
+        d_ino = ino;
+        if (sizeof(d_ino) < sizeof(ino) && d_ino != ino)
+                return -EOVERFLOW;
         dirent = buf->previous;
         if (dirent)
                 put_user(offset, &dirent->d_off);
         dirent = buf->current_dir;
         buf->previous = dirent;
-        put_user(ino, &dirent->d_ino);
+        put_user(d_ino, &dirent->d_ino);
         put_user(reclen, &dirent->d_reclen);
         put_user(namlen, &dirent->d_namlen);
         copy_to_user(dirent->d_name, name, namlen);
diff --git a/arch/parisc/kernel/sys_parisc32.c b/arch/parisc/kernel/sys_parisc32.c
index b74869803081..e3b30bc36453 100644
--- a/arch/parisc/kernel/sys_parisc32.c
+++ b/arch/parisc/kernel/sys_parisc32.c
@@ -237,14 +237,19 @@ int sys32_settimeofday(struct compat_timeval __user *tv, struct timezone __user
 
 int cp_compat_stat(struct kstat *stat, struct compat_stat __user *statbuf)
 {
+        compat_ino_t ino;
         int err;
 
         if (stat->size > MAX_NON_LFS || !new_valid_dev(stat->dev) ||
             !new_valid_dev(stat->rdev))
                 return -EOVERFLOW;
 
+        ino = stat->ino;
+        if (sizeof(ino) < sizeof(stat->ino) && ino != stat->ino)
+                return -EOVERFLOW;
+
         err  = put_user(new_encode_dev(stat->dev), &statbuf->st_dev);
-        err |= put_user(stat->ino, &statbuf->st_ino);
+        err |= put_user(ino, &statbuf->st_ino);
         err |= put_user(stat->mode, &statbuf->st_mode);
         err |= put_user(stat->nlink, &statbuf->st_nlink);
         err |= put_user(0, &statbuf->st_reserved1);
@@ -312,16 +317,20 @@ filldir32 (void *__buf, const char *name, int namlen, loff_t offset, ino_t ino,
         struct linux32_dirent __user * dirent;
         struct getdents32_callback * buf = (struct getdents32_callback *) __buf;
         int reclen = ROUND_UP(NAME_OFFSET(dirent) + namlen + 1, 4);
+        u32 d_ino;
 
         buf->error = -EINVAL;   /* only used if we fail.. */
         if (reclen > buf->count)
                 return -EINVAL;
+        d_ino = ino;
+        if (sizeof(d_ino) < sizeof(ino) && d_ino != ino)
+                return -EOVERFLOW;
         dirent = buf->previous;
         if (dirent)
                 put_user(offset, &dirent->d_off);
         dirent = buf->current_dir;
         buf->previous = dirent;
-        put_user(ino, &dirent->d_ino);
+        put_user(d_ino, &dirent->d_ino);
         put_user(reclen, &dirent->d_reclen);
         copy_to_user(dirent->d_name, name, namlen);
         put_user(0, dirent->d_name + namlen);
@@ -371,12 +380,16 @@ fillonedir32 (void * __buf, const char * name, int namlen, loff_t offset, ino_t
 {
         struct readdir32_callback * buf = (struct readdir32_callback *) __buf;
         struct old_linux32_dirent __user * dirent;
+        u32 d_ino;
 
         if (buf->count)
                 return -EINVAL;
+        d_ino = ino;
+        if (sizeof(d_ino) < sizeof(ino) && d_ino != ino)
+                return -EOVERFLOW;
         buf->count++;
         dirent = buf->dirent;
-        put_user(ino, &dirent->d_ino);
+        put_user(d_ino, &dirent->d_ino);
         put_user(offset, &dirent->d_offset);
         put_user(namlen, &dirent->d_namlen);
         copy_to_user(dirent->d_name, name, namlen);
diff --git a/arch/powerpc/kernel/sys_ppc32.c b/arch/powerpc/kernel/sys_ppc32.c
index 5e391fc25340..d15c33e95959 100644
--- a/arch/powerpc/kernel/sys_ppc32.c
+++ b/arch/powerpc/kernel/sys_ppc32.c
@@ -69,16 +69,20 @@ struct readdir_callback32 {
 };
 
 static int fillonedir(void * __buf, const char * name, int namlen,
-                                  off_t offset, ino_t ino, unsigned int d_type)
+                                  off_t offset, u64 ino, unsigned int d_type)
 {
         struct readdir_callback32 * buf = (struct readdir_callback32 *) __buf;
         struct old_linux_dirent32 __user * dirent;
+        ino_t d_ino;
 
         if (buf->count)
                 return -EINVAL;
+        d_ino = ino;
+        if (sizeof(d_ino) < sizeof(ino) && d_ino != ino)
+                return -EOVERFLOW;
         buf->count++;
         dirent = buf->dirent;
-        put_user(ino, &dirent->d_ino);
+        put_user(d_ino, &dirent->d_ino);
         put_user(offset, &dirent->d_offset);
         put_user(namlen, &dirent->d_namlen);
         copy_to_user(dirent->d_name, name, namlen);
@@ -120,15 +124,20 @@ asmlinkage long ppc32_select(u32 n, compat_ulong_t __user *inp,
 
 int cp_compat_stat(struct kstat *stat, struct compat_stat __user *statbuf)
 {
+        compat_ino_t ino;
         long err;
 
         if (stat->size > MAX_NON_LFS || !new_valid_dev(stat->dev) ||
             !new_valid_dev(stat->rdev))
                 return -EOVERFLOW;
 
+        ino = stat->ino;
+        if (sizeof(ino) < sizeof(stat->ino) && ino != stat->ino)
+                return -EOVERFLOW;
+
         err  = access_ok(VERIFY_WRITE, statbuf, sizeof(*statbuf)) ? 0 : -EFAULT;
         err |= __put_user(new_encode_dev(stat->dev), &statbuf->st_dev);
-        err |= __put_user(stat->ino, &statbuf->st_ino);
+        err |= __put_user(ino, &statbuf->st_ino);
         err |= __put_user(stat->mode, &statbuf->st_mode);
         err |= __put_user(stat->nlink, &statbuf->st_nlink);
         err |= __put_user(stat->uid, &statbuf->st_uid);
diff --git a/arch/s390/kernel/compat_linux.c b/arch/s390/kernel/compat_linux.c
index c46e3d48e410..e15e1489aef5 100644
--- a/arch/s390/kernel/compat_linux.c
+++ b/arch/s390/kernel/compat_linux.c
@@ -357,11 +357,16 @@ asmlinkage long sys32_ftruncate64(unsigned int fd, unsigned long high, unsigned
 
 int cp_compat_stat(struct kstat *stat, struct compat_stat __user *statbuf)
 {
+        compat_ino_t ino;
         int err;
 
         if (!old_valid_dev(stat->dev) || !old_valid_dev(stat->rdev))
                 return -EOVERFLOW;
 
+        ino = stat->ino;
+        if (sizeof(ino) < sizeof(stat->ino) && ino != stat->ino)
+                return -EOVERFLOW;
+
         err = put_user(old_encode_dev(stat->dev), &statbuf->st_dev);
         err |= put_user(stat->ino, &statbuf->st_ino);
         err |= put_user(stat->mode, &statbuf->st_mode);
diff --git a/arch/sparc/kernel/sys_sunos.c b/arch/sparc/kernel/sys_sunos.c
index 9d2cd97d1c3a..6f3ac548ee66 100644
--- a/arch/sparc/kernel/sys_sunos.c
+++ b/arch/sparc/kernel/sys_sunos.c
@@ -325,21 +325,25 @@ struct sunos_dirent_callback {
 #define ROUND_UP(x) (((x)+sizeof(long)-1) & ~(sizeof(long)-1))
 
 static int sunos_filldir(void * __buf, const char * name, int namlen,
-                         loff_t offset, ino_t ino, unsigned int d_type)
+                         loff_t offset, u64 ino, unsigned int d_type)
 {
         struct sunos_dirent __user *dirent;
         struct sunos_dirent_callback * buf = __buf;
+        unsigned long d_ino;
         int reclen = ROUND_UP(NAME_OFFSET(dirent) + namlen + 1);
 
         buf->error = -EINVAL;   /* only used if we fail.. */
         if (reclen > buf->count)
                 return -EINVAL;
+        d_ino = ino;
+        if (sizeof(d_ino) < sizeof(ino) && d_ino != ino)
+                return -EOVERFLOW;
         dirent = buf->previous;
         if (dirent)
                 put_user(offset, &dirent->d_off);
         dirent = buf->curr;
         buf->previous = dirent;
-        put_user(ino, &dirent->d_ino);
+        put_user(d_ino, &dirent->d_ino);
         put_user(namlen, &dirent->d_namlen);
         put_user(reclen, &dirent->d_reclen);
         copy_to_user(dirent->d_name, name, namlen);
@@ -406,19 +410,23 @@ struct sunos_direntry_callback {
 };
 
 static int sunos_filldirentry(void * __buf, const char * name, int namlen,
-                              loff_t offset, ino_t ino, unsigned int d_type)
+                              loff_t offset, u64 ino, unsigned int d_type)
 {
         struct sunos_direntry __user *dirent;
         struct sunos_direntry_callback *buf = __buf;
+        unsigned long d_ino;
         int reclen = ROUND_UP(NAME_OFFSET(dirent) + namlen + 1);
 
         buf->error = -EINVAL;   /* only used if we fail.. */
         if (reclen > buf->count)
                 return -EINVAL;
+        d_ino = ino;
+        if (sizeof(d_ino) < sizeof(ino) && d_ino != ino)
+                return -EOVERFLOW;
         dirent = buf->previous;
         dirent = buf->curr;
         buf->previous = dirent;
-        put_user(ino, &dirent->d_ino);
+        put_user(d_ino, &dirent->d_ino);
         put_user(namlen, &dirent->d_namlen);
         put_user(reclen, &dirent->d_reclen);
         copy_to_user(dirent->d_name, name, namlen);
diff --git a/arch/sparc64/kernel/sys_sparc32.c b/arch/sparc64/kernel/sys_sparc32.c
index 69444f266e2d..dbc6d1a3be1f 100644
--- a/arch/sparc64/kernel/sys_sparc32.c
+++ b/arch/sparc64/kernel/sys_sparc32.c
@@ -337,12 +337,17 @@ asmlinkage long sys32_ftruncate64(unsigned int fd, unsigned long high, unsigned
 
 int cp_compat_stat(struct kstat *stat, struct compat_stat __user *statbuf)
 {
+        compat_ino_t ino;
         int err;
 
         if (stat->size > MAX_NON_LFS || !old_valid_dev(stat->dev) ||
             !old_valid_dev(stat->rdev))
                 return -EOVERFLOW;
 
+        ino = stat->ino;
+        if (sizeof(ino) < sizeof(stat->ino) && ino != stat->ino)
+                return -EOVERFLOW;
+
         err  = put_user(old_encode_dev(stat->dev), &statbuf->st_dev);
         err |= put_user(stat->ino, &statbuf->st_ino);
         err |= put_user(stat->mode, &statbuf->st_mode);
diff --git a/arch/sparc64/kernel/sys_sunos32.c b/arch/sparc64/kernel/sys_sunos32.c
index 953296b73f3f..e414c8ef0225 100644
--- a/arch/sparc64/kernel/sys_sunos32.c
+++ b/arch/sparc64/kernel/sys_sunos32.c
@@ -280,16 +280,20 @@ static int sunos_filldir(void * __buf, const char * name, int namlen,
         struct sunos_dirent __user *dirent;
         struct sunos_dirent_callback * buf = (struct sunos_dirent_callback *) __buf;
         int reclen = ROUND_UP(NAME_OFFSET(dirent) + namlen + 1);
+        u32 d_ino;
 
         buf->error = -EINVAL;   /* only used if we fail.. */
         if (reclen > buf->count)
                 return -EINVAL;
+        d_ino = ino;
+        if (sizeof(d_ino) < sizeof(ino) && d_ino != ino)
+                return -EOVERFLOW;
         dirent = buf->previous;
         if (dirent)
                 put_user(offset, &dirent->d_off);
         dirent = buf->curr;
         buf->previous = dirent;
-        put_user(ino, &dirent->d_ino);
+        put_user(d_ino, &dirent->d_ino);
         put_user(namlen, &dirent->d_namlen);
         put_user(reclen, &dirent->d_reclen);
         if (copy_to_user(dirent->d_name, name, namlen))
@@ -363,14 +367,18 @@ static int sunos_filldirentry(void * __buf, const char * name, int namlen,
         struct sunos_direntry_callback * buf =
                 (struct sunos_direntry_callback *) __buf;
         int reclen = ROUND_UP(NAME_OFFSET(dirent) + namlen + 1);
+        u32 d_ino;
 
         buf->error = -EINVAL;   /* only used if we fail.. */
         if (reclen > buf->count)
                 return -EINVAL;
+        d_ino = ino;
+        if (sizeof(d_ino) < sizeof(ino) && d_ino != ino)
+                return -EOVERFLOW;
         dirent = buf->previous;
         dirent = buf->curr;
         buf->previous = dirent;
-        put_user(ino, &dirent->d_ino);
+        put_user(d_ino, &dirent->d_ino);
         put_user(namlen, &dirent->d_namlen);
         put_user(reclen, &dirent->d_reclen);
         if (copy_to_user(dirent->d_name, name, namlen))
diff --git a/arch/sparc64/solaris/fs.c b/arch/sparc64/solaris/fs.c
index 0f0eb6aa1c40..12a940cc791f 100644
--- a/arch/sparc64/solaris/fs.c
+++ b/arch/sparc64/solaris/fs.c
@@ -82,12 +82,17 @@ struct sol_stat64 {
 
 static inline int putstat(struct sol_stat __user *ubuf, struct kstat *kbuf)
 {
+        u32 ino;
+
         if (kbuf->size > MAX_NON_LFS ||
             !sysv_valid_dev(kbuf->dev) ||
             !sysv_valid_dev(kbuf->rdev))
                 return -EOVERFLOW;
+        ino = kbuf->ino;
+        if (sizeof(ino) < sizeof(kbuf->ino) && ino != kbuf->ino)
+                return -EOVERFLOW;
         if (put_user (sysv_encode_dev(kbuf->dev), &ubuf->st_dev)        ||
-            __put_user (kbuf->ino, &ubuf->st_ino)               ||
+            __put_user (ino, &ubuf->st_ino)                             ||
             __put_user (kbuf->mode, &ubuf->st_mode)             ||
             __put_user (kbuf->nlink, &ubuf->st_nlink)   ||
             __put_user (kbuf->uid, &ubuf->st_uid)               ||
diff --git a/arch/x86_64/ia32/sys_ia32.c b/arch/x86_64/ia32/sys_ia32.c
index 26a01717cc1a..c9bac3af29d6 100644
--- a/arch/x86_64/ia32/sys_ia32.c
+++ b/arch/x86_64/ia32/sys_ia32.c
@@ -76,6 +76,8 @@
 
 int cp_compat_stat(struct kstat *kbuf, struct compat_stat __user *ubuf)
 {
+        compat_ino_t ino;
+
         typeof(ubuf->st_uid) uid = 0;
         typeof(ubuf->st_gid) gid = 0;
         SET_UID(uid, kbuf->uid);
@@ -84,9 +86,12 @@ int cp_compat_stat(struct kstat *kbuf, struct compat_stat __user *ubuf)
                 return -EOVERFLOW;
         if (kbuf->size >= 0x7fffffff)
                 return -EOVERFLOW;
+        ino = kbuf->ino;
+        if (sizeof(ino) < sizeof(kbuf->ino) && ino != kbuf->ino)
+                return -EOVERFLOW;
         if (!access_ok(VERIFY_WRITE, ubuf, sizeof(struct compat_stat)) ||
             __put_user (old_encode_dev(kbuf->dev), &ubuf->st_dev) ||
-            __put_user (kbuf->ino, &ubuf->st_ino) ||
+            __put_user (ino, &ubuf->st_ino) ||
             __put_user (kbuf->mode, &ubuf->st_mode) ||
             __put_user (kbuf->nlink, &ubuf->st_nlink) ||
             __put_user (uid, &ubuf->st_uid) ||