Re: [BUG] fanotify: WARNING in fanotify_handle_event with crafted msdos image and long path

[OGAWA Hirofumi]

Jan Kara <jack@xxxxxxx> writes:

> On Mon 31-08-26 12:32:57, ZW Tang wrote:
>> I am reporting a warning triggered by a syzkaller reproducer on
>> Linux 7.2.0-rc3. A similar issue appears to have been reported upstream
>> before, but I can still reproduce it on Linux 7.2.0-rc3 with HEAD commit
>> 1137d8b5df06137fb49513cc923b3b24d94cb809.
>> 
>> The reproducer mounts a crafted msdos filesystem image, creates a very
>> long pathname, installs a fanotify mark, and then calls execve() on the
>> long path. During execve(), the file open path triggers fsnotify, which
>> then calls fanotify_handle_event(). While fanotify is constructing the
>> event, it hits a warning in fs/notify/fanotify/fanotify.h.
>> 
>> This looks like a fanotify name-event encoding robustness issue. A crafted
>> filesystem image together with a very long pathname appears to trigger an
>> unexpected name/fid event layout, and fanotify_info_copy_name() reaches a
>> WARN_ON_ONCE() path. The kernel should probably reject or truncate the
>> event cleanly instead of triggering a warning, because panic_on_warn turns
>> this into a kernel panic.
>
> fanotify complains that the name length is greater than NAME_MAX.  If I can
> guess, the problem likely is that the msdos filesystem (vfat?) allows a
> file name that is longer than NAME_MAX. Which would be a bug in the
> filesystem driver, not a problem in fanotify... Ogawa, care to have a look?

A patch looks like be applied to v7.3.
-- 
OGAWA Hirofumi <hirofumi@xxxxxxxxxxxxxxxxxx>