[PATCH nfs-utils v3 06/11] mountd: bound the junction path before copying it into e_path

[Jeff Layton <jlayton@kernel.org>]

create_junction_exportent() strcpy()s the junction pathname into
exportent.e_path, a fixed char[NFS_MAXPATHLEN+1].  Neither downcall
bounds the path first:

 - nfsd_export() sizes it from the 32KiB pipefs channel buffer
 - the netlink path strdup()s it out of NFSD_A_SVC_EXPORT_PATH

A junction more than NFS_MAXPATHLEN bytes deep therefore corrupts the
heap.  Reaching it needs a trusted.junction.nfs xattr, so only server
root can set one up, but the copy should not depend on that.

Reject the path instead, as mkexportent() already does.  The callers
handle a NULL exportent: both downcalls answer negative.

Signed-off-by: Jeff Layton <jlayton@kernel.org>
Assisted-by: LLM
---
 support/export/cache.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/support/export/cache.c b/support/export/cache.c
index 79dd0abe9a1b..6a5cdd9d9670 100644
--- a/support/export/cache.c
+++ b/support/export/cache.c
@@ -3434,6 +3434,12 @@ static struct exportent *create_junction_exportent(struct exportent *parent,
 {
 	static struct exportent *eep;
 
+	if (strlen(junction) >= sizeof(eep->e_path)) {
+		xlog(L_ERROR, "%s: junction path %s too long", __func__,
+		     junction);
+		return NULL;
+	}
+
 	eep = (struct exportent *)malloc(sizeof(*eep));
 	if (eep == NULL)
 		goto out_nomem;

-- 
2.55.0