[PATCH] efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare

[PATCH] efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare

[linan666]

From: Li Nan <linan122@huawei.com>

Observed in kernel 6.6 (likely present on master as well):

  Call trace:
   dump_backtrace+0xe4/0x1c0
   show_stack+0x34/0x50
   dump_stack_lvl+0x70/0x100
   print_address_description.constprop.0+0x84/0x3c0
   print_report+0xb0/0x280
   kasan_report+0x7c/0xc8
   kasan_check_range+0xe8/0x190
   __asan_loadN+0x1c/0x28
   memcmp+0x98/0xd0
   efivarfs_d_compare+0x68/0xd8
   __d_lookup_rcu_op_compare+0x178/0x218
   __d_lookup_rcu+0x1f8/0x228
   d_alloc_parallel+0x150/0x648
   lookup_open.isra.0+0x5f0/0x8d0
   open_last_lookups+0x264/0x828
   path_openat+0x130/0x3f8
   do_filp_open+0x114/0x248
   do_sys_openat2+0x340/0x3c0
   __arm64_sys_openat+0x120/0x1a0
   invoke_syscall+0x78/0x1c8
   el0_svc_common.constprop.0+0x14c/0x188
   do_el0_svc+0x3c/0x58
   el0_svc+0x44/0x1b8
   el0t_64_sync_handler+0x100/0x130
   el0t_64_sync+0x3c8/0x3d0

Crash analysis shows dentry->d_name.len == 35, which makes 'guid'
subtraction negative and triggers the Call trace. Temporarily mitigate
the issue by checking len.

Signed-off-by: Li Nan <linan122@huawei.com>
---
 fs/efivarfs/super.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c
index 23ff4e873651..c30d758e303a 100644
--- a/fs/efivarfs/super.c
+++ b/fs/efivarfs/super.c
@@ -152,7 +152,7 @@ static int efivarfs_d_compare(const struct dentry *dentry,
 {
 	int guid = len - EFI_VARIABLE_GUID_LEN;
 
-	if (name->len != len)
+	if (name->len != len || len <= EFI_VARIABLE_GUID_LEN)
 		return 1;
 
 	/* Case-sensitive compare for the variable name */
-- 
2.39.2