efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
authorLi Nan <linan122@huawei.com>
Wed, 27 Aug 2025 07:39:54 +0000 (15:39 +0800)
committerArd Biesheuvel <ardb@kernel.org>
Thu, 28 Aug 2025 06:39:49 +0000 (08:39 +0200)
commita6358f8cf64850f3f27857b8ed8c1b08cfc4685c
tree45e7f8d3fb6539bcb04f5b078eb1a3e5757b909a
parent134ed1093907a79e5d98087513f13fd7652c4df9
efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare

Observed on kernel 6.6 (present on master as well):

  BUG: KASAN: slab-out-of-bounds in memcmp+0x98/0xd0
  Call trace:
   kasan_check_range+0xe8/0x190
   __asan_loadN+0x1c/0x28
   memcmp+0x98/0xd0
   efivarfs_d_compare+0x68/0xd8
   __d_lookup_rcu_op_compare+0x178/0x218
   __d_lookup_rcu+0x1f8/0x228
   d_alloc_parallel+0x150/0x648
   lookup_open.isra.0+0x5f0/0x8d0
   open_last_lookups+0x264/0x828
   path_openat+0x130/0x3f8
   do_filp_open+0x114/0x248
   do_sys_openat2+0x340/0x3c0
   __arm64_sys_openat+0x120/0x1a0

If dentry->d_name.len < EFI_VARIABLE_GUID_LEN , 'guid' can become
negative, leadings to oob. The issue can be triggered by parallel
lookups using invalid filename:

  T1 T2
  lookup_open
   ->lookup
    simple_lookup
     d_add
     // invalid dentry is added to hash list

lookup_open
 d_alloc_parallel
  __d_lookup_rcu
   __d_lookup_rcu_op_compare
    hlist_bl_for_each_entry_rcu
    // invalid dentry can be retrieved
     ->d_compare
      efivarfs_d_compare
      // oob

Fix it by checking 'guid' before cmp.

Fixes: da27a24383b2 ("efivarfs: guid part of filenames are case-insensitive")
Signed-off-by: Li Nan <linan122@huawei.com>
Signed-off-by: Wu Guanghao <wuguanghao3@huawei.com>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
fs/efivarfs/super.c