net: nfs: clean up bounds checks in nfs_readlink_reply()

Commit d6694018eadd ("net: nfs: fix buffer overflow in
nfs_readlink_reply()") added bounds checks against sizeof(nfs_path_buff)
before both memcpy() calls. This is a cosmetic cleanup of that fix:

- introduce a local new_len for the relative-path branch so the sum
  pathlen + rlen is computed once and reused for both the bounds check
  and the NUL terminator, rather than being open-coded twice;
- emit a diagnostic when a symlink target is rejected for exceeding the
  buffer, matching the style of other NFS error paths.

No functional change to the accept/reject decision.

This same overflow was independently discovered and privately reported
to the U-Boot maintainers on 2026-04-03, together with a working proof
of concept, ahead of the change that became the fix cited above. This
cleanup restores the local-variable form from that original report.

Signed-off-by: Murtaza Munaim <[email protected]>

1 files changed, 9 insertions, 3 deletions

diff --git a/net/nfs-common.c b/net/nfs-common.c
index 72d8fd823e3..637fcfd9bb8 100644
--- a/net/nfs-common.c
+++ b/net/nfs-common.c
@@ -671,18 +671,24 @@ static int nfs_readlink_reply(uchar *pkt, unsigned int len)
 
 	if (*((char *)&rpc_pkt.u.reply.data[2 + nfsv3_data_offset]) != '/') {
 		int pathlen;
+		int new_len;
 
 		strcat(nfs_path, "/");
 		pathlen = strlen(nfs_path);
-		if (pathlen + rlen >= sizeof(nfs_path_buff))
+		new_len = pathlen + rlen;
+		if (new_len >= sizeof(nfs_path_buff)) {
+			printf("NFS: symlink too long (%d bytes)\n", new_len);
 			return -NFS_RPC_DROP;
+		}
 		memcpy(nfs_path + pathlen,
 		       (uchar *)&rpc_pkt.u.reply.data[2 + nfsv3_data_offset],
 		       rlen);
-		nfs_path[pathlen + rlen] = 0;
+		nfs_path[new_len] = 0;
 	} else {
-		if (rlen >= sizeof(nfs_path_buff))
+		if (rlen >= sizeof(nfs_path_buff)) {
+			printf("NFS: symlink too long (%d bytes)\n", rlen);
 			return -NFS_RPC_DROP;
+		}
 		memcpy(nfs_path,
 		       (uchar *)&rpc_pkt.u.reply.data[2 + nfsv3_data_offset],
 		       rlen);