fanotify: limit the number of marks in a single fanotify group

There is currently no limit on the number of marks a given fanotify group
can have.  Since fanotify is gated on CAP_SYS_ADMIN this was not seen as
a serious DoS threat.  This patch implements a default of 8192, the same as
inotify to work towards removing the CAP_SYS_ADMIN gating and eliminating
the default DoS'able status.

Signed-off-by: Eric Paris <eparis@redhat.com>

diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
index 43d66d9b2eff13b4188c7379bc618ea474047805..1d33d7db277a75e641a486d753acf8ec891c1b89 100644 (file)
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -17,6 +17,7 @@
 #include <asm/ioctls.h>
 
 #define FANOTIFY_DEFAULT_MAX_EVENTS    16384
+#define FANOTIFY_DEFAULT_MAX_MARKS     8192
 
 extern const struct fsnotify_ops fanotify_fsnotify_ops;
 
@@ -584,6 +585,9 @@ static int fanotify_add_vfsmount_mark(struct fsnotify_group *group,
        if (!fsn_mark) {
                int ret;
 
+               if (atomic_read(&group->num_marks) > group->fanotify_data.max_marks)
+                       return -ENOSPC;
+
                fsn_mark = kmem_cache_alloc(fanotify_mark_cache, GFP_KERNEL);
                if (!fsn_mark)
                        return -ENOMEM;
@@ -626,6 +630,9 @@ static int fanotify_add_inode_mark(struct fsnotify_group *group,
        if (!fsn_mark) {
                int ret;
 
+               if (atomic_read(&group->num_marks) > group->fanotify_data.max_marks)
+                       return -ENOSPC;
+
                fsn_mark = kmem_cache_alloc(fanotify_mark_cache, GFP_KERNEL);
                if (!fsn_mark)
                        return -ENOMEM;
@@ -700,6 +707,8 @@ SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags)
                group->max_events = FANOTIFY_DEFAULT_MAX_EVENTS;
        }
 
+       group->fanotify_data.max_marks = FANOTIFY_DEFAULT_MAX_MARKS;
+
        fd = anon_inode_getfd("[fanotify]", &fanotify_fops, group, f_flags);
        if (fd < 0)
                goto out_put_group;

diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h
index b37f3a71a9dc162f5dbf3ea084f17d5c735521e5..49ceed6e92b1af41415a2ba8bf87038fed48de4d 100644 (file)
--- a/include/linux/fsnotify_backend.h
+++ b/include/linux/fsnotify_backend.h
@@ -169,6 +169,7 @@ struct fsnotify_group {
                        bool bypass_perm; /* protected by access_mutex */
 #endif /* CONFIG_FANOTIFY_ACCESS_PERMISSIONS */
                        int f_flags;
+                       unsigned int max_marks;
                } fanotify_data;
 #endif /* CONFIG_FANOTIFY */
        };