fanotify: Allow copying of file handle to userspace (b2d22b6b) · Commits · e / devices / android_kernel_fairphone_FP5

When file handle is embedded inside fanotify_event and usercopy checks are enabled, we get a warning like: Bad or missing usercopy whitelist? Kernel memory exposure attempt detected from SLAB object 'fanotify_event' (offset 40, size 8)! WARNING: CPU: 1 PID: 7649 at mm/usercopy.c:78 usercopy_warn+0xeb/0x110 mm/usercopy.c:78 Annotate handling in fanotify_event properly to mark copying it to userspace is fine. Reported-by:

<syzbot+2c49971e251e36216d1f@syzkaller.appspotmail.com> Fixes: ("fanotify: enable FAN_REPORT_FID init flag") Signed-off-by:

Kees Cook <keescook@chromium.org> Reviewed-by:

Amir Goldstein <amir73il@gmail.com> Signed-off-by:

Jan Kara <jack@suse.cz>

fs/notify/fanotify/fanotify_user.c

+11 −1

Original line number	Diff line number	Diff line
		@@ -208,6 +208,7 @@ static int copy_fid_to_user(struct fanotify_event event, char __user buf)
		{
		struct fanotify_event_info_fid info = { };
		struct file_handle handle = { };
		unsigned char bounce[FANOTIFY_INLINE_FH_LEN], *fh;
		size_t fh_len = event->fh_len;
		size_t len = fanotify_event_info_len(event);

		@@ -233,7 +234,16 @@ static int copy_fid_to_user(struct fanotify_event event, char __user buf)

		buf += sizeof(handle);
		len -= sizeof(handle);
		if (copy_to_user(buf, fanotify_event_fh(event), fh_len))
		/*
		* For an inline fh, copy through stack to exclude the copy from
		* usercopy hardening protections.
		*/
		fh = fanotify_event_fh(event);
		if (fh_len <= FANOTIFY_INLINE_FH_LEN) {
		memcpy(bounce, fh, fh_len);
		fh = bounce;
		}
		if (copy_to_user(buf, fh, fh_len))
		return -EFAULT;

		/* Pad with 0's */