From 85d82c52327552da9e9bd103342d970d49ec262c Mon Sep 17 00:00:00 2001 From: Murtaza Munaim Date: Wed, 22 Jul 2026 23:44:29 +0200 Subject: net: nfs: clean up bounds checks in nfs_readlink_reply() Commit d6694018eadd ("net: nfs: fix buffer overflow in nfs_readlink_reply()") added bounds checks against sizeof(nfs_path_buff) before both memcpy() calls. This is a cosmetic cleanup of that fix: - introduce a local new_len for the relative-path branch so the sum pathlen + rlen is computed once and reused for both the bounds check and the NUL terminator, rather than being open-coded twice; - emit a diagnostic when a symlink target is rejected for exceeding the buffer, matching the style of other NFS error paths. No functional change to the accept/reject decision. This same overflow was independently discovered and privately reported to the U-Boot maintainers on 2026-04-03, together with a working proof of concept, ahead of the change that became the fix cited above. This cleanup restores the local-variable form from that original report. Signed-off-by: Murtaza Munaim --- net/nfs-common.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/net/nfs-common.c b/net/nfs-common.c index 72d8fd823e3..637fcfd9bb8 100644 --- a/net/nfs-common.c +++ b/net/nfs-common.c @@ -671,18 +671,24 @@ static int nfs_readlink_reply(uchar *pkt, unsigned int len) if (*((char *)&rpc_pkt.u.reply.data[2 + nfsv3_data_offset]) != '/') { int pathlen; + int new_len; strcat(nfs_path, "/"); pathlen = strlen(nfs_path); - if (pathlen + rlen >= sizeof(nfs_path_buff)) + new_len = pathlen + rlen; + if (new_len >= sizeof(nfs_path_buff)) { + printf("NFS: symlink too long (%d bytes)\n", new_len); return -NFS_RPC_DROP; + } memcpy(nfs_path + pathlen, (uchar *)&rpc_pkt.u.reply.data[2 + nfsv3_data_offset], rlen); - nfs_path[pathlen + rlen] = 0; + nfs_path[new_len] = 0; } else { - if (rlen >= sizeof(nfs_path_buff)) + if (rlen >= sizeof(nfs_path_buff)) { + printf("NFS: symlink too long (%d bytes)\n", rlen); return -NFS_RPC_DROP; + } memcpy(nfs_path, (uchar *)&rpc_pkt.u.reply.data[2 + nfsv3_data_offset], rlen); -- cgit v1.3.1