8 files changed, 40 insertions, 18 deletions

diff --git a/fs/afs/dir.c b/fs/afs/dir.c
index 2fc99877cb0d..cf8a2cb28505 100644
--- a/fs/afs/dir.c
+++ b/fs/afs/dir.c
@@ -30,7 +30,7 @@ static int afs_dir_readdir(struct file *file, void *dirent, filldir_t filldir);
 static int afs_d_revalidate(struct dentry *dentry, struct nameidata *nd);
 static int afs_d_delete(struct dentry *dentry);
 static int afs_dir_lookup_filldir(void *_cookie, const char *name, int nlen,
-                                  loff_t fpos, ino_t ino, unsigned dtype);
+                                  loff_t fpos, u64 ino, unsigned dtype);
 
 const struct file_operations afs_dir_file_operations = {
         .open           = afs_dir_open,
@@ -409,7 +409,7 @@ static int afs_dir_readdir(struct file *file, void *cookie, filldir_t filldir)
  *   uniquifier through dtype
  */
 static int afs_dir_lookup_filldir(void *_cookie, const char *name, int nlen,
-                                  loff_t fpos, ino_t ino, unsigned dtype)
+                                  loff_t fpos, u64 ino, unsigned dtype)
 {
         struct afs_dir_lookup_cookie *cookie = _cookie;
 
diff --git a/fs/compat.c b/fs/compat.c
index d98c96f4a44d..4d3fbcb2ddb1 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -914,20 +914,24 @@ struct compat_readdir_callback {
 };
 
 static int compat_fillonedir(void *__buf, const char *name, int namlen,
-                        loff_t offset, ino_t ino, unsigned int d_type)
+                        loff_t offset, u64 ino, unsigned int d_type)
 {
         struct compat_readdir_callback *buf = __buf;
         struct compat_old_linux_dirent __user *dirent;
+        compat_ulong_t d_ino;
 
         if (buf->result)
                 return -EINVAL;
+        d_ino = ino;
+        if (sizeof(d_ino) < sizeof(ino) && d_ino != ino)
+                return -EOVERFLOW;
         buf->result++;
         dirent = buf->dirent;
         if (!access_ok(VERIFY_WRITE, dirent,
                         (unsigned long)(dirent->d_name + namlen + 1) -
                                 (unsigned long)dirent))
                 goto efault;
-        if (    __put_user(ino, &dirent->d_ino) ||
+        if (    __put_user(d_ino, &dirent->d_ino) ||
                 __put_user(offset, &dirent->d_offset) ||
                 __put_user(namlen, &dirent->d_namlen) ||
                 __copy_to_user(dirent->d_name, name, namlen) ||
@@ -978,22 +982,26 @@ struct compat_getdents_callback {
 };
 
 static int compat_filldir(void *__buf, const char *name, int namlen,
-                loff_t offset, ino_t ino, unsigned int d_type)
+                loff_t offset, u64 ino, unsigned int d_type)
 {
         struct compat_linux_dirent __user * dirent;
         struct compat_getdents_callback *buf = __buf;
+        compat_ulong_t d_ino;
         int reclen = COMPAT_ROUND_UP(NAME_OFFSET(dirent) + namlen + 2);
 
         buf->error = -EINVAL;   /* only used if we fail.. */
         if (reclen > buf->count)
                 return -EINVAL;
+        d_ino = ino;
+        if (sizeof(d_ino) < sizeof(ino) && d_ino != ino)
+                return -EOVERFLOW;
         dirent = buf->previous;
         if (dirent) {
                 if (__put_user(offset, &dirent->d_off))
                         goto efault;
         }
         dirent = buf->current_dir;
-        if (__put_user(ino, &dirent->d_ino))
+        if (__put_user(d_ino, &dirent->d_ino))
                 goto efault;
         if (__put_user(reclen, &dirent->d_reclen))
                 goto efault;
@@ -1064,7 +1072,7 @@ struct compat_getdents_callback64 {
 };
 
 static int compat_filldir64(void * __buf, const char * name, int namlen, loff_t offset,
-                     ino_t ino, unsigned int d_type)
+                     u64 ino, unsigned int d_type)
 {
         struct linux_dirent64 __user *dirent;
         struct compat_getdents_callback64 *buf = __buf;
diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c
index 4c39009350f3..93e77c3d2490 100644
--- a/fs/exportfs/expfs.c
+++ b/fs/exportfs/expfs.c
@@ -315,7 +315,7 @@ struct getdents_callback {
  * the name matching the specified inode number.
  */
 static int filldir_one(void * __buf, const char * name, int len,
-                        loff_t pos, ino_t ino, unsigned int d_type)
+                        loff_t pos, u64 ino, unsigned int d_type)
 {
         struct getdents_callback *buf = __buf;
         int result = 0;
diff --git a/fs/fat/dir.c b/fs/fat/dir.c
index 3e50a4166283..69c439f44387 100644
--- a/fs/fat/dir.c
+++ b/fs/fat/dir.c
@@ -648,7 +648,7 @@ static int fat_readdir(struct file *filp, void *dirent, filldir_t filldir)
 }
 
 static int fat_ioctl_filldir(void *__buf, const char *name, int name_len,
-                             loff_t offset, ino_t ino, unsigned int d_type)
+                             loff_t offset, u64 ino, unsigned int d_type)
 {
         struct fat_ioctl_filldir_callback *buf = __buf;
         struct dirent __user *d1 = buf->dirent;
diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index e35d7e52fdeb..1cbd2e4ee122 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -184,7 +184,7 @@ struct dentry_list_arg {
 
 static int
 nfsd4_build_dentrylist(void *arg, const char *name, int namlen,
-                loff_t offset, ino_t ino, unsigned int d_type)
+                loff_t offset, u64 ino, unsigned int d_type)
 {
         struct dentry_list_arg *dla = arg;
         struct list_head *dentries = &dla->dentries;
diff --git a/fs/readdir.c b/fs/readdir.c
index b6109329b607..bff3ee58e2f8 100644
--- a/fs/readdir.c
+++ b/fs/readdir.c
@@ -69,20 +69,24 @@ struct readdir_callback {
 };
 
 static int fillonedir(void * __buf, const char * name, int namlen, loff_t offset,
-                      ino_t ino, unsigned int d_type)
+                      u64 ino, unsigned int d_type)
 {
         struct readdir_callback * buf = (struct readdir_callback *) __buf;
         struct old_linux_dirent __user * dirent;
+        unsigned long d_ino;
 
         if (buf->result)
                 return -EINVAL;
+        d_ino = ino;
+        if (sizeof(d_ino) < sizeof(ino) && d_ino != ino)
+                return -EOVERFLOW;
         buf->result++;
         dirent = buf->dirent;
         if (!access_ok(VERIFY_WRITE, dirent,
                         (unsigned long)(dirent->d_name + namlen + 1) -
                                 (unsigned long)dirent))
                 goto efault;
-        if (    __put_user(ino, &dirent->d_ino) ||
+        if (    __put_user(d_ino, &dirent->d_ino) ||
                 __put_user(offset, &dirent->d_offset) ||
                 __put_user(namlen, &dirent->d_namlen) ||
                 __copy_to_user(dirent->d_name, name, namlen) ||
@@ -138,22 +142,26 @@ struct getdents_callback {
 };
 
 static int filldir(void * __buf, const char * name, int namlen, loff_t offset,
-                   ino_t ino, unsigned int d_type)
+                   u64 ino, unsigned int d_type)
 {
         struct linux_dirent __user * dirent;
         struct getdents_callback * buf = (struct getdents_callback *) __buf;
+        unsigned long d_ino;
         int reclen = ROUND_UP(NAME_OFFSET(dirent) + namlen + 2);
 
         buf->error = -EINVAL;   /* only used if we fail.. */
         if (reclen > buf->count)
                 return -EINVAL;
+        d_ino = ino;
+        if (sizeof(d_ino) < sizeof(ino) && d_ino != ino)
+                return -EOVERFLOW;
         dirent = buf->previous;
         if (dirent) {
                 if (__put_user(offset, &dirent->d_off))
                         goto efault;
         }
         dirent = buf->current_dir;
-        if (__put_user(ino, &dirent->d_ino))
+        if (__put_user(d_ino, &dirent->d_ino))
                 goto efault;
         if (__put_user(reclen, &dirent->d_reclen))
                 goto efault;
@@ -222,7 +230,7 @@ struct getdents_callback64 {
 };
 
 static int filldir64(void * __buf, const char * name, int namlen, loff_t offset,
-                     ino_t ino, unsigned int d_type)
+                     u64 ino, unsigned int d_type)
 {
         struct linux_dirent64 __user *dirent;
         struct getdents_callback64 * buf = (struct getdents_callback64 *) __buf;
diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c
index d935fb9394e3..7bdb0ed443e1 100644
--- a/fs/reiserfs/xattr.c
+++ b/fs/reiserfs/xattr.c
@@ -773,7 +773,7 @@ int reiserfs_xattr_del(struct inode *inode, const char *name)
 
 static int
 reiserfs_delete_xattrs_filler(void *buf, const char *name, int namelen,
-                              loff_t offset, ino_t ino, unsigned int d_type)
+                              loff_t offset, u64 ino, unsigned int d_type)
 {
         struct dentry *xadir = (struct dentry *)buf;
 
@@ -851,7 +851,7 @@ struct reiserfs_chown_buf {
 /* XXX: If there is a better way to do this, I'd love to hear about it */
 static int
 reiserfs_chown_xattrs_filler(void *buf, const char *name, int namelen,
-                             loff_t offset, ino_t ino, unsigned int d_type)
+                             loff_t offset, u64 ino, unsigned int d_type)
 {
         struct reiserfs_chown_buf *chown_buf = (struct reiserfs_chown_buf *)buf;
         struct dentry *xafile, *xadir = chown_buf->xadir;
@@ -1036,7 +1036,7 @@ struct reiserfs_listxattr_buf {
 
 static int
 reiserfs_listxattr_filler(void *buf, const char *name, int namelen,
-                          loff_t offset, ino_t ino, unsigned int d_type)
+                          loff_t offset, u64 ino, unsigned int d_type)
 {
         struct reiserfs_listxattr_buf *b = (struct reiserfs_listxattr_buf *)buf;
         int len = 0;
diff --git a/fs/stat.c b/fs/stat.c
index 60a31d5e5966..bca07eb2003c 100644
--- a/fs/stat.c
+++ b/fs/stat.c
@@ -140,6 +140,8 @@ static int cp_old_stat(struct kstat *stat, struct __old_kernel_stat __user * sta
         memset(&tmp, 0, sizeof(struct __old_kernel_stat));
         tmp.st_dev = old_encode_dev(stat->dev);
         tmp.st_ino = stat->ino;
+        if (sizeof(tmp.st_ino) < sizeof(stat->ino) && tmp.st_ino != stat->ino)
+                return -EOVERFLOW;
         tmp.st_mode = stat->mode;
         tmp.st_nlink = stat->nlink;
         if (tmp.st_nlink != stat->nlink)
@@ -210,6 +212,8 @@ static int cp_new_stat(struct kstat *stat, struct stat __user *statbuf)
         tmp.st_dev = new_encode_dev(stat->dev);
 #endif
         tmp.st_ino = stat->ino;
+        if (sizeof(tmp.st_ino) < sizeof(stat->ino) && tmp.st_ino != stat->ino)
+                return -EOVERFLOW;
         tmp.st_mode = stat->mode;
         tmp.st_nlink = stat->nlink;
         if (tmp.st_nlink != stat->nlink)
@@ -347,6 +351,8 @@ static long cp_new_stat64(struct kstat *stat, struct stat64 __user *statbuf)
         tmp.st_rdev = huge_encode_dev(stat->rdev);
 #endif
         tmp.st_ino = stat->ino;
+        if (sizeof(tmp.st_ino) < sizeof(stat->ino) && tmp.st_ino != stat->ino)
+                return -EOVERFLOW;
 #ifdef STAT64_HAS_BROKEN_ST_INO
         tmp.__st_ino = stat->ino;
 #endif