Linux 7.3 Fixes FAT System Bug That Silently Truncated File Names

**The Linux 7.3 kernel includes a fix for the FAT file system driver that for years accepted longer file names than allowed, truncating them silently and causing unexpected behaviors. The bug, discovered by a Huawei engineer, affected data integrity and generated kernel alerts when using functions like open(), although vfat was not compromised.

A Silent Bug at the Heart of FAT

The FAT file system driver in Linux, responsible for supporting FAT12, FAT16, and FAT32, rarely receives significant updates, but for Linux 7.3, a patch has arrived that corrects a faulty behavior that could go unnoticed for a long time. The issue lay in the lack of an upper limit check on the length of file names, allowing excessively long names to be silently truncated, leading to unexpected situations.

When a file name exceeded Linux's NAME_MAX limit of 255 bytes, the driver truncated the excess length without issuing any warning and continued as if the operation had succeeded. This behavior was unintentional, as when subsequently reading those files, the system only matched the truncated bytes, which could lead to inconsistencies and potential data loss.

Huawei engineer Zizhi Wo was the one who detected and resolved the issue in the FAT driver, explaining in the patch message that the msdos_format_name() function did not perform any upper limit checks on the input name length.

The Risk with Extremely Long Names

To illustrate the severity of the bug, Wo provided a concrete example: passing a name of 300 bytes composed solely of 'A's returned 0 as success, with res set to "AAAAAAAA" (eight 'A's plus three padding spaces), reporting success for a name much longer than NAME_MAX. This scenario was not only confusing but could trigger erratic behaviors in the kernel.

When a user called open() with a path component longer than 255 bytes, the VFS system only applied PATH_MAX, not the length of an individual component, so the dentry retained the original long name but was assigned an inode and became positive. This triggered a warning in vfs_open() that propagated to fsnotify_open() and fanotify_info_copy_name(), where WARN_ON_ONCE() was activated, causing the event to be reported to user space with an empty name.

The impact was not limited to an annoying warning but could affect systems that rely on fanotify to monitor file system events. An empty name in the event could break the logic of applications that depend on that information, generating potential vulnerabilities or failures in security monitoring.

Fortunately, the vfat file system was not affected by this issue because its creation passed through xlate_to_uni(), which rejects names longer than FAT_LFN_LEN, a limit of 255 characters.

The Fix Proposed by Huawei

The implemented solution adds a check for 'len > NAME_MAX' in the entry of msdos_format_name(), which is the only entry point for all msdos name handling in the driver. This check aligns with those performed by xfs, 9p, ceph, and simple_lookup() in the lookup, ensuring that no name exceeds the limit set by the system.

This approach guarantees that starting from the Linux 7.3 kernel, any attempt to use a file name longer than 255 bytes in FAT systems will be controlled and rejected, rather than silently truncated. The fix also prevents unnecessary warnings from being triggered in the kernel, improving system stability and security.

The patch has been submitted and is now merged for Linux 7.3, and it is expected to be backported to stable kernels in the near future, so users of distributions that maintain older kernel versions can benefit from this fix.

Such bugs, although infrequent in an old driver like FAT, underscore the importance of keeping systems updated and reviewing the code that handles critical operations like file access.