[syzbot] [afs?] WARNING in __proc_create (3)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 059dd502b263 Merge tag 'block-6.13-20241228' of git://git...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=125ac6df980000
kernel config: https://syzkaller.appspot.com/x/.config?x=c078001e66e4a17e
dashboard link: https://syzkaller.appspot.com/bug?extid=7848fee1f1e5c53f912b
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=165ac6df980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1755b0b0580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/b23b5d964e6e/disk-059dd502.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6c382805ea80/vmlinux-059dd502.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b17a5405f713/bzImage-059dd502.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+7848fe...@syzkaller.appspotmail.com

------------[ cut here ]------------
name len 256
WARNING: CPU: 0 PID: 9 at fs/proc/generic.c:405 __proc_create+0x75c/0x8b0 fs/proc/generic.c:405
Modules linked in:
CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Not tainted 6.13.0-rc4-syzkaller-00078-g059dd502b263 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: afs afs_manage_cell_work
RIP: 0010:__proc_create+0x75c/0x8b0 fs/proc/generic.c:405
Code: 80 3c 02 00 0f 85 61 01 00 00 4d 8b 3c 24 e9 17 fb ff ff e8 56 92 63 ff 90 8b 74 24 04 48 c7 c7 00 6a 61 8b e8 85 58 24 ff 90 <0f> 0b 90 90 e9 7b ff ff ff 4c 89 ef e8 a3 01 c6 ff e9 9e fa ff ff
RSP: 0018:ffffc900000e7a38 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 1ffff9200001cf49 RCX: ffffffff815a1729
RDX: ffff88801bee8000 RSI: ffffffff815a1736 RDI: 0000000000000001
RBP: 0000000000000100 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: ffffc900000e7b28
R13: ffff88802a3fa000 R14: 00000000000000ff R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000002b2e2000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
_proc_mkdir+0xbb/0x200 fs/proc/generic.c:489
proc_net_mkdir include/linux/proc_fs.h:232 [inline]
afs_proc_cell_setup+0xbe/0x200 fs/afs/proc.c:682
afs_activate_cell fs/afs/cell.c:681 [inline]
afs_manage_cell fs/afs/cell.c:761 [inline]
afs_manage_cell_work+0x614/0x14b0 fs/afs/cell.c:828
process_one_work+0x958/0x1b30 kernel/workqueue.c:3229
process_scheduled_works kernel/workqueue.c:3310 [inline]
worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[David Howells]

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

afs: Fix the maximum cell name length

The kafs filesystem limits the maximum length of a cell to 256 bytes, but a
problem occurs if someone actually does that: kafs tries to create a
directory under /proc/net/afs/ with the name of the cell, but that fails
with a warning:

WARNING: CPU: 0 PID: 9 at fs/proc/generic.c:405

because procfs limits the maximum filename length to 255.

However, the DNS limits the maximum lookup length and, by extension, the
maximum cell name, to 255 less two (length count and trailing NUL).

Fix this by limiting the maximum acceptable cellname length to 253. This
also allows us to be sure we can create the "/afs/.<cell>/" mountpoint too.

Further, split the YFS VL record cell name maximum to be the 256 allowed by
the protocol and ignore the record retrieved by YFSVL.GetCellName if it
exceeds 253.

Fixes: c3e9f888263b ("afs: Implement client support for the YFSVL.GetCellName RPC op")
Reported-by: syzbot+7848fe...@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/6776d25d.050a022...@google.com/
Signed-off-by: David Howells <dhow...@redhat.com>
cc: Marc Dionne <marc....@auristor.com>
cc: linu...@lists.infradead.org
---
fs/afs/afs.h | 2 +-
fs/afs/afs_vl.h | 1 +
fs/afs/vl_alias.c | 8 ++++++--
fs/afs/vlclient.c | 2 +-
4 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/fs/afs/afs.h b/fs/afs/afs.h
index b488072aee87..ec3db00bd081 100644
--- a/fs/afs/afs.h
+++ b/fs/afs/afs.h
@@ -10,7 +10,7 @@

#include <linux/in.h>

-#define AFS_MAXCELLNAME 256 /* Maximum length of a cell name */
+#define AFS_MAXCELLNAME 253 /* Maximum length of a cell name (DNS limited) */
#define AFS_MAXVOLNAME 64 /* Maximum length of a volume name */
#define AFS_MAXNSERVERS 8 /* Maximum servers in a basic volume record */
#define AFS_NMAXNSERVERS 13 /* Maximum servers in a N/U-class volume record */
diff --git a/fs/afs/afs_vl.h b/fs/afs/afs_vl.h
index a06296c8827d..b835e25a2c02 100644
--- a/fs/afs/afs_vl.h
+++ b/fs/afs/afs_vl.h
@@ -13,6 +13,7 @@
#define AFS_VL_PORT 7003 /* volume location service port */
#define VL_SERVICE 52 /* RxRPC service ID for the Volume Location service */
#define YFS_VL_SERVICE 2503 /* Service ID for AuriStor upgraded VL service */
+#define YFS_VL_MAXCELLNAME 256 /* Maximum length of a cell name in YFS protocol */

enum AFSVL_Operations {
VLGETENTRYBYID = 503, /* AFS Get VLDB entry by ID */
diff --git a/fs/afs/vl_alias.c b/fs/afs/vl_alias.c
index 9f36e14f1c2d..f9e76b604f31 100644
--- a/fs/afs/vl_alias.c
+++ b/fs/afs/vl_alias.c
@@ -253,6 +253,7 @@ static char *afs_vl_get_cell_name(struct afs_cell *cell, struct key *key)
static int yfs_check_canonical_cell_name(struct afs_cell *cell, struct key *key)
{
struct afs_cell *master;
+ size_t name_len;
char *cell_name;

cell_name = afs_vl_get_cell_name(cell, key);
@@ -264,8 +265,11 @@ static int yfs_check_canonical_cell_name(struct afs_cell *cell, struct key *key)
return 0;
}

- master = afs_lookup_cell(cell->net, cell_name, strlen(cell_name),
- NULL, false);
+ name_len = strlen(cell_name);
+ if (!name_len || name_len > AFS_MAXCELLNAME)
+ master = ERR_PTR(-EOPNOTSUPP);
+ else
+ master = afs_lookup_cell(cell->net, cell_name, name_len, NULL, false);
kfree(cell_name);
if (IS_ERR(master))
return PTR_ERR(master);
diff --git a/fs/afs/vlclient.c b/fs/afs/vlclient.c
index cac75f89b64a..55dd0fc5aad7 100644
--- a/fs/afs/vlclient.c
+++ b/fs/afs/vlclient.c
@@ -697,7 +697,7 @@ static int afs_deliver_yfsvl_get_cell_name(struct afs_call *call)
return ret;

namesz = ntohl(call->tmp);
- if (namesz > AFS_MAXCELLNAME)
+ if (namesz > YFS_VL_MAXCELLNAME)
return afs_protocol_error(call, afs_eproto_cellname_len);
paddedsz = (namesz + 3) & ~3;
call->count = namesz;

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+7848fe...@syzkaller.appspotmail.com
Tested-by: syzbot+7848fe...@syzkaller.appspotmail.com

Tested on:

commit: 13563da6 Merge tag 'vfio-v6.13-rc7' of https://github...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=173cb418580000
kernel config: https://syzkaller.appspot.com/x/.config?x=ad08f7f48e13abcd

dashboard link: https://syzkaller.appspot.com/bug?extid=7848fee1f1e5c53f912b
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=122cb418580000

Note: testing is done by a robot and is best-effort only.