Shared-folder dir entries carry host-reported size and length fields.
vboxsf_dir_emit() checks that name.size fits in the returned buffer, but
later passes name.length to vboxsf_nlscpy() or dir_emit() unchecked, so
malformed host data can make the guest read past the shfl_string buffer.

Reject entries whose name.length exceeds name.size before either consumer.

Fixes: 0fd169576648 ("fs: Add VirtualBox guest shared folder (vboxsf) support")
Assisted-by: Claude:claude-fable-5
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
---
 fs/vboxsf/dir.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/vboxsf/dir.c b/fs/vboxsf/dir.c
index 42bedc4ec7af7..702d243169936 100644
--- a/fs/vboxsf/dir.c
+++ b/fs/vboxsf/dir.c
@@ -129,6 +129,8 @@ static bool vboxsf_dir_emit(struct file *dir, struct dir_context *ctx)
 		end = &info->name.string.utf8[info->name.size];
 		if (WARN_ON(end > (b->buf + b->used)))
 			return false;
+		if (info->name.length > info->name.size)
+			return false;
 
 		/* Info now points to the right entry, emit it. */
 		d_type = vboxsf_get_d_type(info->info.attr.mode);
-- 
2.53.0