[PATCH 1/6] fs: skip directory entries whose name does not fit struct dirent

[Ahmad Fatoum]

From: Ahmad Fatoum <a.fatoum at barebox.org>

fillonedir() copies whatever name length the file system reports into
the fixed 256 byte d_name of struct dirent. A longer name overruns the
heap allocation and a 256 byte one is left without a terminating NUL.

Such names do exist: ubootvarfs lists U-Boot environment variables,
whose names have no length limit and come from a medium the OS can
rewrite, and ramfs accepts file names of any length. An environment
with a 300 byte variable name corrupts the heap as soon as the
directory is listed.

Let's skip these entries with a warning instead. The rest of the
directory is still listed and the file remains accessible by name.

Fixes: b3fbfad7aeaf ("fs: dentry cache implementation")
Assisted-by: Claude:opus-5.5
Signed-off-by: Ahmad Fatoum <a.fatoum at barebox.org>
---
 fs/fs.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/fs.c b/fs/fs.c
index 1426ce4bc883..e18e3b9cd7b2 100644
--- a/fs/fs.c
+++ b/fs/fs.c
@@ -1088,6 +1088,11 @@ static int fillonedir(struct dir_context *ctx, const char *name, int namlen,
 	struct readdir_callback *rd = container_of(ctx, struct readdir_callback, ctx);
 	struct readdir_entry *entry;
 
+	if (namlen >= sizeof(entry->d.d_name)) {
+		pr_warn("skipping directory entry %.32s...: name too long\n", name);
+		return 0;
+	}
+
 	entry = xzalloc(sizeof(*entry));
 	memcpy(entry->d.d_name, name, namlen);
 	list_add_tail(&entry->list, &rd->dir->entries);
-- 
2.47.3