nfsd: fix memory overflow for haddr

nfsd: fix memory overflow for haddr

[zhangjian (CG)]

when hcounter is not 0, haddr memory is not enough.
asan report heap-buffer-overflow error in following scene:
CFLAGS="-fsanitize=address -g" ./configure && make
./utils/nfsd/nfsd -H 192.168.1.1 -H 192.168.1.2

Signed-off-by: zhangjian <zhangjian496@huawei.com>
---
 utils/nfsd/nfsd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/utils/nfsd/nfsd.c b/utils/nfsd/nfsd.c
index c95d32f4..e3fcdde4 100644
--- a/utils/nfsd/nfsd.c
+++ b/utils/nfsd/nfsd.c
@@ -185,7 +185,7 @@ main(int argc, char **argv)
 				hcounter = 0;
 			}
 			if (hcounter) {
-				haddr = realloc(haddr, sizeof(char*) * hcounter+1);
+				haddr = realloc(haddr, sizeof(char*) * (hcounter+1));
 				if(!haddr) {
 					fprintf(stderr, "%s: unable to allocate "
 							"memory.\n", progname);
-- 
2.33.0

Re: nfsd: fix memory overflow for haddr

[Chuck Lever]

Hi -


On Tue, Jul 14, 2026, at 4:43 AM, zhangjian (CG) wrote:
> when hcounter is not 0, haddr memory is not enough.
> asan report heap-buffer-overflow error in following scene:
> CFLAGS="-fsanitize=address -g" ./configure && make
> ./utils/nfsd/nfsd -H 192.168.1.1 -H 192.168.1.2
>
> Signed-off-by: zhangjian <zhangjian496@huawei.com>
> ---
>  utils/nfsd/nfsd.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/utils/nfsd/nfsd.c b/utils/nfsd/nfsd.c
> index c95d32f4..e3fcdde4 100644
> --- a/utils/nfsd/nfsd.c
> +++ b/utils/nfsd/nfsd.c
> @@ -185,7 +185,7 @@ main(int argc, char **argv)
>  				hcounter = 0;
>  			}
>  			if (hcounter) {
> -				haddr = realloc(haddr, sizeof(char*) * hcounter+1);
> +				haddr = realloc(haddr, sizeof(char*) * (hcounter+1));
>  				if(!haddr) {
>  					fprintf(stderr, "%s: unable to allocate "
>  							"memory.\n", progname);
> -- 
> 2.33.0

A couple of notes regarding patch submission process:

You sent this To: chuck.lever and prefixed the Subject with
"nfsd:" so I assumed it was for the Linux in-kernel NFS
server. In fact, it's for nfs-utils. Steve might not
recognize that he is responsible for this patch. I suggest
using "nfs-utils:" instead for such patches (including the
preceding patch labeled "gssd:").

Second, your email transfer agent's DKIM is misconfigured.
This security feature is tested by our patch intake tooling
as a way to spot bogus submitters. b4 reported this when I
imported your patch:

  ✗ [PATCH] nfsd: fix memory overflow for haddr
    + Link: https://patch.msgid.link/356736aa-25d8-4b79-a50f-33b4e7035856@huawei.com
  ---
  ✗ BADSIG: DKIM/h-partners.com

This might become a blocking gate for future submissions, so
you should speak with your email administrator to get this
corrected.


-- 
Chuck Lever