[PATCH] fs: efivarfs: skip variables whose name does not fit struct dirent

[PATCH] fs: efivarfs: skip variables whose name does not fit struct dirent

[Ahmad Fatoum]

From: Ahmad Fatoum <a.fatoum@barebox.org>

efivarfs fills struct dirent in its own readdir, so it doesn't benefit
from the length check in fillonedir() and strcpy()s the variable name
and GUID suffix into the 256 byte d_name unchecked.

The names come from the firmware, which allows up to 1023 characters
here, and efivars_create() takes them from the path, so creating a
variable with a 300 character name and listing /efivars overruns the
directory allocation.

Let's skip such variables with a warning like fillonedir() does.

Fixes: ef4f9d77b72c ("fs: implement EFI variable filesystem driver")
Assisted-by: Claude:opus-5.5
Signed-off-by: Ahmad Fatoum <a.fatoum@barebox.org>
---
 fs/efivarfs.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/fs/efivarfs.c b/fs/efivarfs.c
index b9f514c51cd9..da826234b959 100644
--- a/fs/efivarfs.c
+++ b/fs/efivarfs.c
@@ -261,16 +261,22 @@ static struct dirent *efivarfs_readdir(struct device *dev, DIR *dir)
 	struct efivarfs_dir *edir = container_of(dir, struct efivarfs_dir, dir);
 	struct efivarfs_inode *inode;
 
-	if (edir->current == &priv->inodes)
-		return NULL;
+	while (edir->current != &priv->inodes) {
+		inode = list_entry(edir->current, struct efivarfs_inode, node);
+		edir->current = edir->current->next;
 
-	inode = list_entry(edir->current, struct efivarfs_inode, node);
+		if (strlen(inode->full_name) >= sizeof(dir->d.d_name)) {
+			pr_warn("skipping variable %.32s...: name too long\n",
+				inode->full_name);
+			continue;
+		}
 
-	strcpy(dir->d.d_name, inode->full_name);
+		strcpy(dir->d.d_name, inode->full_name);
 
-	edir->current = edir->current->next;
+		return &dir->d;
+	}
 
-	return &dir->d;
+	return NULL;
 }
 
 static int efivarfs_closedir(struct device *dev, DIR *dir)
-- 
2.47.3