[PATCH] net: nfs: fix buffer overflow in nfs_readlink_reply()

[Jerome Forissier]

On 09/04/2026 18:44, Sebastian Alba Vives wrote:
> From: Sebastian Josue Alba Vives <sebasjosue84 at gmail.com>
> 
> nfs_readlink_reply() validates rlen only against the incoming packet
> length (inherited from CVE-2019-14195), but not against the destination
> buffer nfs_path_buff[2048]. A malicious NFS server can send a valid
> READLINK reply where pathlen + rlen exceeds sizeof(nfs_path_buff),
> overflowing the BSS buffer into adjacent memory.
> 
> The recent fix in fd6e3d34097f addressed the same overflow class in
> net/lwip/nfs.c but left the legacy path in net/nfs-common.c unpatched.
> 
> Add bounds checks before both memcpy calls in nfs_readlink_reply():
> - relative path branch: reject if pathlen + rlen >= sizeof(nfs_path_buff)
> - absolute path branch: reject if rlen >= sizeof(nfs_path_buff)
> 
> Fixes: cf3a4f1e86 ("net: nfs: Fix CVE-2019-14195")
> Cc: stable at vger.kernel.org
> Signed-off-by: Sebastian Alba Vives <sebasjosue84 at gmail.com>
> ---
>  net/nfs-common.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/net/nfs-common.c b/net/nfs-common.c
> index 4fbde67a..72d8fd82 100644
> --- a/net/nfs-common.c
> +++ b/net/nfs-common.c
> @@ -674,11 +674,15 @@ static int nfs_readlink_reply(uchar *pkt, unsigned int len)
>  
>  		strcat(nfs_path, "/");
>  		pathlen = strlen(nfs_path);
> +		if (pathlen + rlen >= sizeof(nfs_path_buff))
> +			return -NFS_RPC_DROP;
>  		memcpy(nfs_path + pathlen,
>  		       (uchar *)&rpc_pkt.u.reply.data[2 + nfsv3_data_offset],
>  		       rlen);
>  		nfs_path[pathlen + rlen] = 0;
>  	} else {
> +		if (rlen >= sizeof(nfs_path_buff))
> +			return -NFS_RPC_DROP;
>  		memcpy(nfs_path,
>  		       (uchar *)&rpc_pkt.u.reply.data[2 + nfsv3_data_offset],
>  		       rlen);

Reviewed-by: Jerome Forissier <jerome.forissier at arm.com>

Added to my net queue, thanks!

-- 
Jerome