get_name_filldir() copies a directory entry name into the caller's fixed
GFS2_FNAMESIZE-byte buffer with memcpy(gnfd->name, name, length) without
checking length against GFS2_FNAMESIZE. A gfs2 directory entry whose name
length exceeds GFS2_FNAMESIZE, as produced by a corrupted or crafted
on-disk directory, overflows the buffer.

Impact: an out-of-bounds write past the GFS2_FNAMESIZE name buffer (KASAN)
in the NFS-export get_name path, reachable when a gfs2 filesystem carrying
a crafted directory entry is re-exported over NFS.

Reject entries whose name length exceeds GFS2_FNAMESIZE before the copy.

Fixes: b3b94faa5fe5 ("[GFS2] The core of GFS2")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
---
 fs/gfs2/export.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/gfs2/export.c b/fs/gfs2/export.c
index 3334c394ce9cb..7b28f1eb9ad0d 100644
--- a/fs/gfs2/export.c
+++ b/fs/gfs2/export.c
@@ -76,6 +76,9 @@ static bool get_name_filldir(struct dir_context *ctx, const char *name,
 	if (inum != gnfd->inum.no_addr)
 		return true;
 
+	if (length > GFS2_FNAMESIZE)
+		return false;
+
 	memcpy(gnfd->name, name, length);
 	gnfd->name[length] = 0;
 
-- 
2.53.0

On 11/07/2026 16:08, Michael Bommarito wrote:
> get_name_filldir() copies a directory entry name into the caller's fixed
> GFS2_FNAMESIZE-byte buffer with memcpy(gnfd->name, name, length) without

I don't see a GFS2_FNAMESIZE-byte buffer but it looks like gnfd->name is pointing to the `char nbuf[NAME_MAX+1]` in exportfs_decode_fh_raw(), but that's just a 1-byte difference so it doesn't change the conversation much.

> checking length against GFS2_FNAMESIZE. A gfs2 directory entry whose name
> length exceeds GFS2_FNAMESIZE, as produced by a corrupted or crafted
> on-disk directory, overflows the buffer.

I think the on-disk dirents should have been checked closer to the dirent read path before we get to the get_name() path.

> Impact: an out-of-bounds write past the GFS2_FNAMESIZE name buffer (KASAN)

Do you have a KASAN backtrace?

> in the NFS-export get_name path, reachable when a gfs2 filesystem carrying
> a crafted directory entry is re-exported over NFS.
> 
> Reject entries whose name length exceeds GFS2_FNAMESIZE before the copy.
> 

gfs2_check_dirent() is likely a better place to add the validation.

Andy

> Fixes: b3b94faa5fe5 ("[GFS2] The core of GFS2")
> Cc: stable@vger.kernel.org
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
> ---
>  fs/gfs2/export.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/fs/gfs2/export.c b/fs/gfs2/export.c
> index 3334c394ce9cb..7b28f1eb9ad0d 100644
> --- a/fs/gfs2/export.c
> +++ b/fs/gfs2/export.c
> @@ -76,6 +76,9 @@ static bool get_name_filldir(struct dir_context *ctx, const char *name,
>  	if (inum != gnfd->inum.no_addr)
>  		return true;
>  
> +	if (length > GFS2_FNAMESIZE)
> +		return false;
> +
>  	memcpy(gnfd->name, name, length);
>  	gnfd->name[length] = 0;
>