Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Sun, 1 Nov 2020 23:27:59 +0100
From:   =?utf-8?B?UGF3ZcWC?= Jasiak <pawel@jasiak.xyz>
To:     Matthew Wilcox <willy@infradead.org>
Cc:     linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org,
        jack@suse.cz
Subject: Re: PROBLEM: fanotify_mark EFAULT on x86
Message-ID: <20201101222759.GA25654@gmail.com>
References: <20201101212738.GA16924@gmail.com>
 <20201101213845.GH27442@casper.infradead.org>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
        protocol="application/pgp-signature"; boundary="BXVAT5kNtrzKuDFl"
Content-Disposition: inline
In-Reply-To: <20201101213845.GH27442@casper.infradead.org>
Precedence: bulk


--BXVAT5kNtrzKuDFl
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On 01/11/20, Matthew Wilcox wrote:
> On Sun, Nov 01, 2020 at 10:27:38PM +0100, Pawe=C5=82 Jasiak wrote:
> > I am trying to run examples from man fanotify.7 but fanotify_mark always
> > fail with errno =3D EFAULT.
> >=20
> > fanotify_mark declaration is
> >=20
> > SYSCALL_DEFINE5(fanotify_mark, int, fanotify_fd, unsigned int, flags,
> > 			      __u64, mask, int, dfd,
> > 			      const char  __user *, pathname)
>=20
> Don't worry about that.  You aren't calling the SYSCALL, you're calling
> glibc and glibc is turning it into a syscall.
>=20
> extern int fanotify_mark (int __fanotify_fd, unsigned int __flags,
>                           uint64_t __mask, int __dfd, const char *__pathn=
ame)
>=20
> > When=20
> >=20
> > fanotify_mark(4, FAN_MARK_ADD | FAN_MARK_ONLYDIR,
> >               FAN_CREATE | FAN_ONDIR, AT_FDCWD, 0xdeadc0de)
>=20
> The last argument is supposed to be a pointer to a string.  I'm guessing
> there's no string at 0xdeadc0de.

You are right but it's not a problem. 0xdeadc0de is just a _well
known_ address here only for debug purpose.

pathname inside kernel should be a pointer to string located in
user space at 0xdeadc0de but it is equal to 0xffffff9c which is
AT_FDCWD.

If you call

fanotify_mark(fd, FAN_MARK_ADD | FAN_MARK_ONLYDIR, FAN_CREATE |
              FAN_ONDIR, AT_FDCWD, argv[1]);

=66rom example with *valid* pointer at argv[1] you still get EFAULT
because pathname is equal to AT_FDCWD in kernel space -- last argument
is not used.

In my example in user space we have
    fanotify_fd =3D 4
    flags       =3D 0x9
    mask        =3D 0x40000100
    dfd         =3D 0xffffff9c
    pathname    =3D 0xdeadc0de

and in kernel space we have
    fanotify_fd =3D 4
    flags       =3D 0x9
    mask        =3D 0x40000100
    dfd         =3D 0
    pathname    =3D 0xffffff9c

So all arguments after __u64 mask are shifted by one.

It looks similar to https://lists.linux.it/pipermail/ltp/2020-June/017436.h=
tml

--=20

Pawe=C5=82 Jasiak

--BXVAT5kNtrzKuDFl
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEENIqkLxDcCMlLMdi0FzfmQudzVTgFAl+fNmwACgkQFzfmQudz
VTjRZhAA4fB7nZEsrAZKgFmixIZd5ROhKQIcstuQhSmfyve0iAWRyOS7XzxtNG98
u2qsUkddRorMb2RCp/Tns6zGrUsFQCv+Yy74Td/w91r/GjCHCDdVCq4bU9q1tlsj
DGKLCYLVxzFr5h41/xn3TJ9FSMwZI4y+b08FcUKNdclA/jzT1RTzoNPo1q4iSTlI
baF4Hx/kalIM7F7qV2zGgXnhTd45uDMJv8UAUN1Ky7h6wHCjZ/DzcBbn1WWGWmyw
zJYSybXbAUhBj8VJUHuuubB9zDUWAcohBQ2JmwjxawIgDHmgJ3FLqNx3hkoY8WC6
G7f4gTZbqR7vWbgSEHsM9lg6vVH4VOSaSxvtwJOlB80wc6fTBi/cC/PyUBIP/KDI
8wl7003QMJI4UcrbojE+0QhWxFPRdH364qdGDlcb7B2/q9ckYuy/r5Oe10jVt/k+
f6lvGbXmveehYSgD5KWmF0LjrqtGL0m1EbxaeeJcTimcGCdBHJwxPDQ5tFXk7SM2
hkm2Xl++Jhk7gOrO4dYxrebgOkwYpyoMAPtwHZ2P4GGMdJUOM2FB8Jy2bEvMeeF4
eGsblO2Zy6V5KHRRNq8jt03jc24XDS7OJoiA5vN3RHV58UgLFfeVz6QemuBsInwL
9RC/ebRA8GBZXL6L8mVftY0olWjItiwgDVHwlLceUY/pIjPa1is=
=Dvh3
-----END PGP SIGNATURE-----

--BXVAT5kNtrzKuDFl--