net: nfs: fix buffer overflow in nfs_readlink_reply()

nfs_readlink_reply() validates rlen only against the incoming packet
length (inherited from CVE-2019-14195), but not against the destination
buffer nfs_path_buff[2048]. A malicious NFS server can send a valid
READLINK reply where pathlen + rlen exceeds sizeof(nfs_path_buff),
overflowing the BSS buffer into adjacent memory.

The recent fix in fd6e3d34097f addressed the same overflow class in
net/lwip/nfs.c but left the legacy path in net/nfs-common.c unpatched.

Add bounds checks before both memcpy calls in nfs_readlink_reply():
- relative path branch: reject if pathlen + rlen >= sizeof(nfs_path_buff)
- absolute path branch: reject if rlen >= sizeof(nfs_path_buff)

Fixes: cf3a4f1e86 ("net: nfs: Fix CVE-2019-14195")
Cc: [email protected]
Signed-off-by: Sebastian Alba Vives <[email protected]>
Reviewed-by: Jerome Forissier <[email protected]>

0 files changed, 0 insertions, 0 deletions