u-boot.git/net/nfs-common.c, branch main

net: nfs: fix buffer overflow in nfs_readlink_reply()

2026-05-06T09:07:22Z

nfs_readlink_reply() validates rlen only against the incoming packet length (inherited from CVE-2019-14195), but not against the destination buffer nfs_path_buff[2048]. A malicious NFS server can send a valid READLINK reply where pathlen + rlen exceeds sizeof(nfs_path_buff), overflowing the BSS buffer into adjacent memory. The recent fix in fd6e3d34097f addressed the same overflow class in net/lwip/nfs.c but left the legacy path in net/nfs-common.c unpatched. Add bounds checks before both memcpy calls in nfs_readlink_reply(): - relative path branch: reject if pathlen + rlen >= sizeof(nfs_path_buff) - absolute path branch: reject if rlen >= sizeof(nfs_path_buff) Fixes: cf3a4f1e86 ("net: nfs: Fix CVE-2019-14195") Cc: stable@vger.kernel.org Signed-off-by: Sebastian Alba Vives Reviewed-by: Jerome Forissier

net: lwip: nfs: Port the NFS code to work with lwIP

2026-01-15T10:09:28Z

After the preparatory patches moved most of the NFS code into common files we now add the code to enable NFS support with lwIP. Signed-off-by: Andrew Goodbody Acked-by: Jerome Forissier

net: nfs: Move most NFS code to common files

2026-01-15T10:09:28Z

Move most of the NFS code into common files so that it can be used by an lwIP port of NFS. Acked-by: Jerome Forissier Signed-off-by: Andrew Goodbody