From: Ahmad Fatoum <[email protected]>
efivarfs fills struct dirent in its own readdir, so it doesn't benefit
from the length check in fillonedir() and strcpy()s the variable name
and GUID suffix into the 256 byte d_name unchecked.
The names come from the firmware, which allows up to 1023 characters
here, and efivars_create() takes them from the path, so creating a
variable with a 300 character name and listing /efivars overruns the
directory allocation.
Let's skip such variables with a warning like fillonedir() does.
Fixes: ef4f9d77b72c ("fs: implement EFI variable filesystem driver")
Assisted-by: Claude:opus-5.5
Signed-off-by: Ahmad Fatoum <[email protected]>
---
fs/efivarfs.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
diff --git a/fs/efivarfs.c b/fs/efivarfs.c
index b9f514c51cd9..da826234b959 100644
--- a/fs/efivarfs.c
+++ b/fs/efivarfs.c
@@ -261,16 +261,22 @@ static struct dirent *efivarfs_readdir(struct device
*dev, DIR *dir)
struct efivarfs_dir *edir = container_of(dir, struct efivarfs_dir, dir);
struct efivarfs_inode *inode;
- if (edir->current == &priv->inodes)
- return NULL;
+ while (edir->current != &priv->inodes) {
+ inode = list_entry(edir->current, struct efivarfs_inode, node);
+ edir->current = edir->current->next;
- inode = list_entry(edir->current, struct efivarfs_inode, node);
+ if (strlen(inode->full_name) >= sizeof(dir->d.d_name)) {
+ pr_warn("skipping variable %.32s...: name too long\n",
+ inode->full_name);
+ continue;
+ }
- strcpy(dir->d.d_name, inode->full_name);
+ strcpy(dir->d.d_name, inode->full_name);
- edir->current = edir->current->next;
+ return &dir->d;
+ }
- return &dir->d;
+ return NULL;
}
static int efivarfs_closedir(struct device *dev, DIR *dir)
--
2.47.3
