Dmitry Safonov

A vulnerability has been resolved in the Linux kernel related to the overlayfs file system. The issue arises when the `ovl encode fh()` function fails to encode a file handle from a non-aliased inode, leading to a failure to report an fid with FAN DELETE SELF fanotify events. The `WARN ON()` assertion in `inotify show fdinfo()` was removed because it is possible for encoding file handle to fail for other reasons. The impact of failing to encode an overlayfs file handle goes beyond this assertion. The `ovl encode fh()` function seldom uses the alias and in the case of non-decodable file handles, it never needs to use the alias to encode a file handle. Defer finding an alias until it is actually needed so `ovl encode fh()` will not fail in the common case of FAN DELETE SELF fanotify events.

The issue is related to the encoding of file handles in the Linux kernel. The `encode fh()` method may fail for various reasons, and some users of `exportfs encode {fh,fid}()` have a `WARN ON()` assertion when this failure occurs. However, this assertion is incorrect and has been relaxed. The legacy users of `exportfs encode fh()`, such as `nfsd` and the `name to handle at(2)` syscall, are prepared to handle the possibility of failure to encode a file handle.

The issue is related to a potential Spectre v1 gadget in the `xfrm xlate32 attr()` function. This could allow an attacker to leak kernel memory content to malicious users. The vulnerability is caused by the use of the `type` variable as an array index, which can be exploited to bypass security measures. The `array index nospec()` function can be used to prevent this type of attack.