[PATCH 0/2] net: nfs: reject an out-of-range NFS read length

A malicious NFS server can return a READ reply whose 32-bit length has
the top bit set. nfs_read_reply() keeps it in a signed int, the bounds
check is defeated on LP64 because the value is negative, and store_block()
then hands a ~2 GB length to memcpy(), which reads past the 1152-byte
reply buffer on the stack and writes past image_load_addr. Both the
classic and the lwIP NFS clients reach this through nfs_pkt_recv().

Patch 1 bounds the length by NFS_READ_SIZE, the amount a read ever
requests, before it is used. Patch 2 adds a DM regression test that
drives nfs_pkt_recv() with a crafted reply; under CONFIG_ASAN it reports
a stack-buffer-overflow in store_block().

A reproducer is available on request.

Signed-off-by: Shahriyar Jalayeri <[email protected]>
---
Shahriyar Jalayeri (2):
      net: nfs: reject a negative or oversized NFS read length
      test: dm: nfs: add a regression test for an oversized NFS read length

 net/nfs-common.c |  4 ++++
 test/dm/Makefile |  1 +
 test/dm/nfs.c    | 55 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 60 insertions(+)
---
base-commit: baa64b2f892890f00a377eac4a3e685472bb56b5
change-id: 20260811-nfs-oob-fix-31c433a22c91

Best regards,
--  
Shahriyar Jalayeri <[email protected]>