[PATCH 0/3] fuse, fsnotify: handle embedded NUL names safely

[Junyoung Jang <graypanda.inzag@gmail.com>]

FUSE readdir and readdirplus parse dirent->namelen without checking for
embedded NUL bytes. Through READDIRPLUS (fuse_direntplus_link()), such a
name can instantiate or alias a dentry in dcache whose qstr length
extends past the first NUL.

When fsnotify records that dentry name, both inotify and fanotify size
the event buffer from qstr->len and copy that full length to userspace,
but populate the buffer with strscpy(). Because strscpy() stops at the
embedded NUL, the trailing heap bytes remain uninitialized.

Patch 1 rejects dirent names containing embedded NULs in FUSE.
Patch 2 zero-pads inotify event names through their recorded length.
Patch 3 zero-pads fanotify event names through their recorded lengths.

Each patch applies and builds independently on mainline commit
23c62304dde2, so the FUSE and fsnotify changes can go through their
respective trees separately.

Testing on x86_64 QEMU:
  - 1/3: Crafted FUSE READDIR and READDIRPLUS entries with embedded NUL
         names were accepted before the patch and rejected with -EIO
         afterward.
  - 2/3: With Patch 1 omitted, FUSE READDIRPLUS + inotify leaked stale
         slab bytes past the embedded NUL to userspace before the patch,
         and returned zeroes afterward.
  - 3/3: Default FUSE mounts report a zero fsid, so fanotify_mark() with
         FAN_REPORT_DFID_NAME returns -ENODEV on the FUSE setup;
         regression-tested FAN_REPORT_DFID_NAME create and FAN_RENAME
         events on tmpfs.

A custom LLM agent assisted with initial discovery and reproducer
setup; all root-cause analysis, patches, and runtime tests were
manually reviewed and verified by the authors.

Junyoung Jang (3):
  fuse: reject embedded NULs in readdir entry names
  inotify: zero-pad event names after an embedded NUL
  fanotify: zero-pad copied event names after an embedded NUL

 fs/fuse/readdir.c                    | 12 +++++++++---
 fs/notify/fanotify/fanotify.h        |  4 ++--
 fs/notify/inotify/inotify_fsnotify.c |  2 +-
 3 files changed, 12 insertions(+), 6 deletions(-)