fanotify: Avoid lost events due to ENOMEM for unlimited queues

Fanotify queues of unlimited length do not expect events can be lost.
Since these queues are used for system auditing and other security
related tasks, loosing events can even have security implications.
Currently, since the allocation is small (32-bytes), it cannot fail
however when we start accounting events in memcgs, allocation can start
failing. So avoid loosing events due to failure to allocate memory by
making event allocation use __GFP_NOFAIL.

Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>

diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c
index 6702a6a0bbb543698509cdc2d367ec3ce68974f1..928f2a5eedb72eff36e1982f01de7021a14f999f 100644 (file)
--- a/fs/notify/fanotify/fanotify.c
+++ b/fs/notify/fanotify/fanotify.c
@@ -139,23 +139,32 @@ static bool fanotify_should_send_event(struct fsnotify_mark *inode_mark,
        return false;
 }
 
-struct fanotify_event_info *fanotify_alloc_event(struct inode *inode, u32 mask,
+struct fanotify_event_info *fanotify_alloc_event(struct fsnotify_group *group,
+                                                struct inode *inode, u32 mask,
                                                 const struct path *path)
 {
        struct fanotify_event_info *event;
+       gfp_t gfp = GFP_KERNEL;
+
+       /*
+        * For queues with unlimited length lost events are not expected and
+        * can possibly have security implications. Avoid losing events when
+        * memory is short.
+        */
+       if (group->max_events == UINT_MAX)
+               gfp |= __GFP_NOFAIL;
 
        if (fanotify_is_perm_event(mask)) {
                struct fanotify_perm_event_info *pevent;
 
-               pevent = kmem_cache_alloc(fanotify_perm_event_cachep,
-                                         GFP_KERNEL);
+               pevent = kmem_cache_alloc(fanotify_perm_event_cachep, gfp);
                if (!pevent)
                        return NULL;
                event = &pevent->fae;
                pevent->response = 0;
                goto init;
        }
-       event = kmem_cache_alloc(fanotify_event_cachep, GFP_KERNEL);
+       event = kmem_cache_alloc(fanotify_event_cachep, gfp);
        if (!event)
                return NULL;
 init: __maybe_unused
@@ -210,7 +219,7 @@ static int fanotify_handle_event(struct fsnotify_group *group,
                        return 0;
        }
 
-       event = fanotify_alloc_event(inode, mask, data);
+       event = fanotify_alloc_event(group, inode, mask, data);
        ret = -ENOMEM;
        if (unlikely(!event))
                goto finish;

diff --git a/fs/notify/fanotify/fanotify.h b/fs/notify/fanotify/fanotify.h
index 256d9d1ddea9c691ab81a4c35a6746ddc1f87951..8609ba06f4745769e70a69e61a4f0813b0902477 100644 (file)
--- a/fs/notify/fanotify/fanotify.h
+++ b/fs/notify/fanotify/fanotify.h
@@ -52,5 +52,6 @@ static inline struct fanotify_event_info *FANOTIFY_E(struct fsnotify_event *fse)
        return container_of(fse, struct fanotify_event_info, fse);
 }
 
-struct fanotify_event_info *fanotify_alloc_event(struct inode *inode, u32 mask,
+struct fanotify_event_info *fanotify_alloc_event(struct fsnotify_group *group,
+                                                struct inode *inode, u32 mask,
                                                 const struct path *path);

diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
index c07eb3d655eaeb3be93c8245ba3dd5fa279320ac..72e367822efb4a5c56f064cdcaf1fbaf30dff19d 100644 (file)
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -757,7 +757,7 @@ SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags)
        group->fanotify_data.user = user;
        atomic_inc(&user->fanotify_listeners);
 
-       oevent = fanotify_alloc_event(NULL, FS_Q_OVERFLOW, NULL);
+       oevent = fanotify_alloc_event(group, NULL, FS_Q_OVERFLOW, NULL);
        if (unlikely(!oevent)) {
                fd = -ENOMEM;
                goto out_destroy_group;