From: Ahmad Fatoum <[email protected]>

Creating a file named x=y on ubootvarfs stores the variable as
"x=y=<value>". That works until the environment is parsed again, which
splits it at the first '=' into a variable x with the value
"y=<value>". The file the user created is gone after a remount or
reboot and another one has taken its place.

U-Boot cannot represent such a name either, so let's refuse to create
it with -EINVAL.

Fixes: 8daaa21b3949 ("fs: Add a driver to access U-Boot environment variables")
Assisted-by: Claude:opus-5.5
Signed-off-by: Ahmad Fatoum <[email protected]>
---
 fs/ubootvarfs.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/ubootvarfs.c b/fs/ubootvarfs.c
index 72d0627fb0cd..b0353d7cedef 100644
--- a/fs/ubootvarfs.c
+++ b/fs/ubootvarfs.c
@@ -281,6 +281,11 @@ static int ubootvarfs_create(struct inode *dir, struct 
dentry *dentry,
        struct inode *inode;
        struct ubootvarfs_var *var;
        size_t len = strlen(dentry->name);
+
+       /* U-Boot splits a variable at its first '=' */
+       if (strchr(dentry->name, '='))
+               return -EINVAL;
+
        /*
         * We'll be adding <varname>=\0\0 to the end of our data, so
         * we need to make sure there's enough room for it. Note that
-- 
2.47.3


Reply via email to