#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master Add comprehensive validation of file handle type and data in nsfs_fh_to_dentry() to prevent processing of handles with incorrect types or malformed data. This fixes a warning triggered when open_by_handle_at() is called with invalid handle data on nsfs files. The issue occurs when a user provides a file handle with an incorrect handle type or valid FILEID_NSFS type but malformed data structure. Although the export subsystem routes the call to nsfs, the function needs to validate that both the handle type and data are appropriate for nsfs files. The reproducer sends fh_type=0xf1 (FILEID_NSFS) but with a data structure from FILEID_INO32_GEN_PARENT, resulting in invalid ns_type values that trigger warnings in the namespace lookup code. Reported-by: syzbot+9eefe09bedd093f156c2@syzkaller.appspotmail.com Signed-off-by: Deepanshu Kartikey --- fs/nsfs.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/fs/nsfs.c b/fs/nsfs.c index 32cb8c835a2b..7f3c8e8c97e2 100644 --- a/fs/nsfs.c +++ b/fs/nsfs.c @@ -461,8 +461,17 @@ static int nsfs_encode_fh(struct inode *inode, u32 *fh, int *max_len, static struct dentry *nsfs_fh_to_dentry(struct super_block *sb, struct fid *fh, int fh_len, int fh_type) { + if (fh_type != FILEID_NSFS) + return ERR_PTR(-EINVAL); + if (fh_len < sizeof(struct nsfs_file_handle) / sizeof(u32)) + return ERR_PTR(-EINVAL); struct path path __free(path_put) = {}; struct nsfs_file_handle *fid = (struct nsfs_file_handle *)fh; + if (fid->ns_type != CLONE_NEWNS && fid->ns_type != CLONE_NEWCGROUP && + fid->ns_type != CLONE_NEWUTS && fid->ns_type != CLONE_NEWIPC && + fid->ns_type != CLONE_NEWUSER && fid->ns_type != CLONE_NEWPID && + fid->ns_type != CLONE_NEWNET) + return ERR_PTR(-EINVAL); struct user_namespace *owning_ns = NULL; struct ns_common *ns; int ret; -- 2.43.0