[PATCH RFC nfs-utils v2 09/10] nfsdctl: reject a listener insertion when the table is full

[Jeff Layton <jlayton@kernel.org>]

parse_listener_get() stops at MAX_NFSD_SOCKETS and publishes
nfsd_socket_count = MAX_NFSD_SOCKETS. update_listeners() then scans the
whole table for a match, finds none because every slot is taken, and
forms &nfsd_sockets[MAX_NFSD_SOCKETS] for the insert. The memcpy() of
res->ai_addr writes one element past the array.

Reachable only with 256 listeners already up, and the count comes from
the kernel rather than the network, so this is hardening.

Signed-off-by: Jeff Layton <jlayton@kernel.org>
---
 utils/nfsdctl/nfsdctl.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/utils/nfsdctl/nfsdctl.c b/utils/nfsdctl/nfsdctl.c
index a2b5dea75dac..7464baad279f 100644
--- a/utils/nfsdctl/nfsdctl.c
+++ b/utils/nfsdctl/nfsdctl.c
@@ -1425,8 +1425,16 @@ static int update_listeners(const char *str)
 			break;
 		}
 		if (!found && sign == '+') {
-			struct server_socket *sock = &nfsd_sockets[nfsd_socket_count];
+			struct server_socket *sock;
 
+			if (nfsd_socket_count >= MAX_NFSD_SOCKETS) {
+				xlog(L_ERROR, "Too many listeners, max is %d",
+				     MAX_NFSD_SOCKETS);
+				free(buf);
+				return -ENOSPC;
+			}
+
+			sock = &nfsd_sockets[nfsd_socket_count];
 			memcpy(&sock->ss, res->ai_addr, res->ai_addrlen);
 			strncpy(sock->name, netid, MAX_CLASS_NAME_LEN);
 			sock->name[MAX_CLASS_NAME_LEN - 1] = '\0';

-- 
2.55.0