Linux 7.3 Corrects Faulty Behavior Of FAT File-System Driver For Filenames Too Fat
The Linux FAT driver has received an update in Linux 7.3 to correct a faulty behavior that could lead to unexpected situations with extremely long filenames. The driver lacked an upper-bounds check on the length of the filename, which could result in silent truncation of …
Intelligence analysis by Llama
The Linux FAT driver has been updated in Linux 7.3 to correct a faulty behavior that could lead to unexpected situations with extremely long filenames. The driver now includes an upper-bounds check on the input name length to prevent silent truncation of the excess length.
Imagine you have a really long file name, like 300 characters long. The Linux FAT driver used to not check if the file name was too long, so it would just cut off the extra characters and pretend it was a shorter name. This could cause problems when trying to open the file. The update in Linux 7.3 fixes this issue by adding a check to make sure the file name is not too long.
Analysis
Correcting a Faulty Behavior in the Linux FAT Driver
The Linux FAT driver has received an update in Linux 7.3 to correct a faulty behavior that could lead to unexpected situations with extremely long filenames. This behavior was caused by the driver lacking an upper-bounds check on the length of the filename, which could result in silent truncation of the excess length.
The issue was discovered by Huawei engineer Zizhi Wo, who found that the msdos_format_name() function performed no upper-bound check on the input name length. This function silently truncates an arbitrarily long name into the 8.3 form (11 bytes) and returns success. The subsequent fat_scan() function then matches only against these 11 truncated bytes, so it returns an inode as long as any entry with the same 8.3 name exists on disk.
For example, passing a 300-byte name of all 'A's returns 0 with res set to "AAAAAAAA" (8 'A's + 3 padding spaces), reporting success for a name far longer than NAME_MAX. As a result, when a user calls open() on a path component longer than NAME_MAX (255) bytes, the VFS only enforces PATH_MAX, not the length of an individual component. The dentry keeps the original long name but gets an inode attached and becomes positive. Later in vfs_open() -> fsnotify_open() -> fanotify_info_copy_name() triggers WARN_ON_ONCE(), and the event is reported to userspace with an empty name.
The fix for this issue was to add two new lines of code to the msdos_format_name() function to check for the upper-bounds check on the input name length. This check was added to align with the NAME_MAX check that xfs/9p/ceph/simple_lookup() perform at lookup.
The patch was submitted and now merged for Linux 7.3, and it will also be back-ported to stable kernels in the near future.
Key points
- The Linux FAT driver has been updated in Linux 7.3 to correct a faulty behavior that could lead to unexpected situations with extremely long filenames.
- The driver now includes an upper-bounds check on the input name length to prevent silent truncation of the excess length.
- The fix was submitted and now merged for Linux 7.3, and it will also be back-ported to stable kernels in the near future.
This update should improve the stability and reliability of the Linux FAT driver, making it a more robust and secure option for users who work with FAT file systems.
If the update is not properly tested and validated, it could potentially introduce new bugs or issues that could affect the stability and reliability of the Linux FAT driver.
