]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
fanotify: sanitize handle_type values when reporting fid
authorAmir Goldstein <amir73il@gmail.com>
Fri, 27 Jun 2025 10:48:35 +0000 (12:48 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 15 Aug 2025 10:08:52 +0000 (12:08 +0200)
commit45338af03ff3cb85403e6f88032b3f42eb968622
treea45267b7f1d301e4da8363ec487677a68e3c1a2c
parente8b4c9e60a7ac54d190f896725c372ac11f814ee
fanotify: sanitize handle_type values when reporting fid

[ Upstream commit 8631e01c2c5d1fe6705bcc0d733a0b7a17d3daac ]

Unlike file_handle, type and len of struct fanotify_fh are u8.
Traditionally, filesystem return handle_type < 0xff, but there
is no enforecement for that in vfs.

Add a sanity check in fanotify to avoid truncating handle_type
if its value is > 0xff.

Fixes: 7cdafe6cc4a6 ("exportfs: check for error return value from exportfs_encode_*()")
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20250627104835.184495-1-amir73il@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
fs/notify/fanotify/fanotify.c