[PATCH] gfs2: reject an over-long name in get_name_filldir

[Michael Bommarito]

get_name_filldir() copies a directory entry name into the caller's fixed
GFS2_FNAMESIZE-byte buffer with memcpy(gnfd->name, name, length) without
checking length against GFS2_FNAMESIZE. A gfs2 directory entry whose name
length exceeds GFS2_FNAMESIZE, as produced by a corrupted or crafted
on-disk directory, overflows the buffer.

Impact: an out-of-bounds write past the GFS2_FNAMESIZE name buffer (KASAN)
in the NFS-export get_name path, reachable when a gfs2 filesystem carrying
a crafted directory entry is re-exported over NFS.

Reject entries whose name length exceeds GFS2_FNAMESIZE before the copy.

Fixes: b3b94faa5fe5 ("[GFS2] The core of GFS2")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@xxxxxxxxx>
---
 fs/gfs2/export.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/gfs2/export.c b/fs/gfs2/export.c
index 3334c394ce9cb..7b28f1eb9ad0d 100644
--- a/fs/gfs2/export.c
+++ b/fs/gfs2/export.c
@@ -76,6 +76,9 @@ static bool get_name_filldir(struct dir_context *ctx, const char *name,
 	if (inum != gnfd->inum.no_addr)
 		return true;
 
+	if (length > GFS2_FNAMESIZE)
+		return false;
+
 	memcpy(gnfd->name, name, length);
 	gnfd->name[length] = 0;
 
-- 
2.53.0