From: Ahmad Fatoum <[email protected]>
fillonedir() copies whatever name length the file system reports into
the fixed 256 byte d_name of struct dirent. A longer name overruns the
heap allocation and a 256 byte one is left without a terminating NUL.
Such names do exist: ubootvarfs lists U-Boot environment variables,
whose names have no length limit and come from a medium the OS can
rewrite, and ramfs accepts file names of any length. An environment
with a 300 byte variable name corrupts the heap as soon as the
directory is listed.
Let's skip these entries with a warning instead. The rest of the
directory is still listed and the file remains accessible by name.
Fixes: b3fbfad7aeaf ("fs: dentry cache implementation")
Assisted-by: Claude:opus-5.5
Signed-off-by: Ahmad Fatoum <[email protected]>
---
fs/fs.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/fs/fs.c b/fs/fs.c
index 1426ce4bc883..e18e3b9cd7b2 100644
--- a/fs/fs.c
+++ b/fs/fs.c
@@ -1088,6 +1088,11 @@ static int fillonedir(struct dir_context *ctx, const
char *name, int namlen,
struct readdir_callback *rd = container_of(ctx, struct
readdir_callback, ctx);
struct readdir_entry *entry;
+ if (namlen >= sizeof(entry->d.d_name)) {
+ pr_warn("skipping directory entry %.32s...: name too long\n",
name);
+ return 0;
+ }
+
entry = xzalloc(sizeof(*entry));
memcpy(entry->d.d_name, name, namlen);
list_add_tail(&entry->list, &rd->dir->entries);
--
2.47.3
