[PATCH RFC nfs-utils v2 10/10] nfsdctl: check the netlink attribute puts in set_listeners()

[Jeff Layton <jlayton@kernel.org>]

nla_nest_start() only reserves a 4-byte header, so it still succeeds on
a message that has no room for the 128-byte sockaddr that follows. The
puts inside the nest went unchecked, so an over-full message was sent
with silently truncated listener nests. The kernel then rejects it with
EINVAL, which says nothing about what went wrong.

MAX_NFSD_SOCKETS is 256 and nlmsg_alloc() defaults to one page, so
roughly 28 listeners overflow.

Signed-off-by: Jeff Layton <jlayton@kernel.org>
---
 utils/nfsdctl/nfsdctl.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/utils/nfsdctl/nfsdctl.c b/utils/nfsdctl/nfsdctl.c
index 7464baad279f..505b38d695ab 100644
--- a/utils/nfsdctl/nfsdctl.c
+++ b/utils/nfsdctl/nfsdctl.c
@@ -1493,8 +1493,14 @@ static int set_listeners(struct nl_sock *sock)
 			goto out;
 		}
 
-		nla_put(msg, NFSD_A_SOCK_ADDR, sizeof(sock->ss), &sock->ss);
-		nla_put_string(msg, NFSD_A_SOCK_TRANSPORT_NAME, sock->name);
+		if (nla_put(msg, NFSD_A_SOCK_ADDR, sizeof(sock->ss),
+			    &sock->ss) ||
+		    nla_put_string(msg, NFSD_A_SOCK_TRANSPORT_NAME,
+				   sock->name)) {
+			xlog(L_ERROR, "Too many listeners for one netlink message");
+			ret = 1;
+			goto out;
+		}
 		nla_nest_end(msg, a);
 	}
 

-- 
2.55.0