[PATCH 0/4] Bounds/overflow hardening in NFS, FIT, TFTP and ext4

[Sriram Sriram <sriramsriram@linux.microsoft.com>]

This series collects four independent robustness fixes to network, boot
image and filesystem code that handle attacker-influenced or on-disk
input. Each was found by auditing length handling around memcpy(),
integer arithmetic on packet/image data, and loop-counter widths.

  1. net: nfs: the NFS client copies received UDP payloads into a
     stack-allocated struct rpc_t with memcpy() using the wire length
     without checking it against the destination size, allowing a
     malicious NFS server to overflow the stack buffer. Add a bounds
     check at each copy site.

  2. boot: image-fit: the decompression path computes the output buffer
     size as 'len * 20', which can wrap on 32/64-bit ulong for a large
     image and cause a heap buffer overflow. Reject sizes that would
     overflow before the multiplication.

  3. net: tftp: the OACK option parser uses strcasecmp() on packet data
     that may not be NUL-terminated within the received length, causing
     an out-of-bounds read. Use a bounded strncasecmp() plus an explicit
     terminator check.

  4. fs: ext4: ext4fs_update() walks all block groups with a signed
     16-bit loop counter while fs->no_blkgrp is a uint32_t. A filesystem
     with more than 32767 block groups overflows the counter (undefined
     behaviour) and the bitmap write-back loops fail to terminate
     correctly. Widen the counter to u32.

The fixes are independent and can be applied in any order. Built for
sandbox (net/tftp.o, boot/image-fit.o, fs/ext4/ext4_write.o, and
net/nfs-common.o with CONFIG_CMD_NFS=y) and checked with
scripts/checkpatch.pl.

Daniel Munic (1):
  fs: ext4: widen ext4fs_update() block-group loop counter

Drew Kluemke (3):
  net: nfs: add bounds checks on memcpy into stack-allocated rpc_pkt
  boot: image-fit: add overflow guard for FIT decompression buffer
  net: tftp: use bounded string compare for OACK option parsing

 boot/image-fit.c     | 10 +++++++++-
 fs/ext4/ext4_write.c |  2 +-
 net/nfs-common.c     | 10 ++++++++++
 net/tftp.c           | 13 +++++++++----
 4 files changed, 29 insertions(+), 6 deletions(-)

-- 
2.49.0