[PATCH] romfs: reject short MTD reads in strnlen/strcmp helpers

[Muhammad Bilal <meatuni001@gmail.com>]

romfs_mtd_strnlen() and romfs_mtd_strcmp() assume each ROMFS_MTD_READ()
call fully satisfies the requested segment length. Neither checks the
returned length before using it.

If mtd_read() ever returns success with retlen 0 for a nonzero
request, romfs_mtd_strnlen() makes no progress on maxlen/pos/n and
loops forever. romfs_mtd_strcmp() decrements the size_t length by one
to drop the padding byte it asked for; with retlen 0 that underflows
to SIZE_MAX, and the following memcmp()/buf[len] run far outside the
16/17-byte stack buffers.

romfs_mtd_read() already treats "rlen != buflen" as -EIO for plain
reads; apply the same requirement here so a short read is rejected
instead of silently mishandled.

Fixes: da4458bda237 ("NOMMU: Make it possible for RomFS to use MTD devices directly")
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
---
 fs/romfs/storage.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/romfs/storage.c b/fs/romfs/storage.c
index b57b3ffcbc32..6313e218b8da 100644
--- a/fs/romfs/storage.c
+++ b/fs/romfs/storage.c
@@ -48,6 +48,8 @@ static ssize_t romfs_mtd_strnlen(struct super_block *sb,
 		ret = ROMFS_MTD_READ(sb, pos, segment, &len, buf);
 		if (ret < 0)
 			return ret;
+		if (len != segment)
+			return -EIO;
 		p = memchr(buf, 0, len);
 		if (p)
 			return n + (p - buf);
@@ -79,6 +81,8 @@ static int romfs_mtd_strcmp(struct super_block *sb, unsigned long pos,
 		ret = ROMFS_MTD_READ(sb, pos, segment, &len, buf);
 		if (ret < 0)
 			return ret;
+		if (len != segment)
+			return -EIO;
 		len--;
 		if (memcmp(buf, str, len) != 0)
 			return 0;
-- 
2.55.0