linux-kernel - PROBLEM: fanotify

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 1 Nov 2020 22:27:38 +0100
From:   Paweł Jasiak <pawel@...iak.xyz>
To:     linux-kernel@...r.kernel.org
Cc:     linux-fsdevel@...r.kernel.org, jack@...e.cz
Subject: PROBLEM: fanotify_mark EFAULT on x86

I am trying to run examples from man fanotify.7 but fanotify_mark always
fail with errno = EFAULT.

fanotify_mark declaration is

SYSCALL_DEFINE5(fanotify_mark, int, fanotify_fd, unsigned int, flags,
			      __u64, mask, int, dfd,
			      const char  __user *, pathname)

When 

fanotify_mark(4, FAN_MARK_ADD | FAN_MARK_ONLYDIR,
              FAN_CREATE | FAN_ONDIR, AT_FDCWD, 0xdeadc0de)

is called on kernel side I can see in do_syscall_32_irqs_on that CPU
context is
    bx = 0x4        = 4
    cx = 0x9        = FAN_MARK_ADD | FAN_MARK_ONLYDIR,
    dx = 0x40000100 = FAN_CREATE | FAN_ONDIR
    si = 0x0
    di = 0xffffff9c = AT_FDCWD
    bp = 0xdeadc0de
    ax = 0xffffffda
    orix_ax = 0x153

I am not sure if it is ok because third argument is uint64_t so if I
understand correctly mask should be divided into two registers (dx and
si).

But in fanotify_mark we get
    fanotify_fd = 4          = bx
    flags       = 0x9        = cx
    mask        = 0x40000100 = dx
    dfd         = 0          = si
    pathname    = 0xffffff9c = di

I believe that correct order is
    fanotify_fd = 4          = bx
    flags       = 0x9        = cx
    mask        = 0x40000100 = (si << 32) | dx
    dfd         = 0xffffff9c = di
    pathname    = 0xdeadc0de = bp

I think that we should call COMPAT version of fanotify_mark here

COMPAT_SYSCALL_DEFINE6(fanotify_mark,
				int, fanotify_fd, unsigned int, flags,
				__u32, mask0, __u32, mask1, int, dfd,
				const char  __user *, pathname)

or something wrong is with 64-bits arguments.

I am running Linux 5.9.2 i686 on Pentium III (Coppermine).
For tests I am using Debian sid on qemu with 5.9.2 and default kernel
from repositories.

Everything works fine on 5.5 and 5.4.

-- 

Paweł Jasiak

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)