A malicious NFS server can return a READ reply whose 32-bit length has the top bit set. nfs_read_reply() keeps it in a signed int, the bounds check is defeated on LP64 because the value is negative, and store_block() then hands a ~2 GB length to memcpy(), which reads past the 1152-byte reply buffer on the stack and writes past image_load_addr. Both the classic and the lwIP NFS clients reach this through nfs_pkt_recv().
Patch 1 bounds the length by NFS_READ_SIZE, the amount a read ever requests, before it is used. Patch 2 adds a DM regression test that drives nfs_pkt_recv() with a crafted reply; under CONFIG_ASAN it reports a stack-buffer-overflow in store_block(). A reproducer is available on request. Signed-off-by: Shahriyar Jalayeri <[email protected]> --- Shahriyar Jalayeri (2): net: nfs: reject a negative or oversized NFS read length test: dm: nfs: add a regression test for an oversized NFS read length net/nfs-common.c | 4 ++++ test/dm/Makefile | 1 + test/dm/nfs.c | 55 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 60 insertions(+) --- base-commit: baa64b2f892890f00a377eac4a3e685472bb56b5 change-id: 20260811-nfs-oob-fix-31c433a22c91 Best regards, -- Shahriyar Jalayeri <[email protected]>
