Bug 1243234

Summary: exportfs: code defect, when export path length > 986, buffer overflow.
Product: Red Hat Enterprise Linux 7 Reporter: JianHong Yin <jiyin>
Component: nfs-utilsAssignee: Steve Dickson <steved>
Status: CLOSED ERRATA QA Contact: Yongcheng Yang <yoyang>
Severity: high Docs Contact:
Priority: unspecified    
Version: 7.2CC: eguan, jiyin, yoyang
Target Milestone: rcKeywords: EasyFix, Patch
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: nfs-utils-1.3.0-0.25.el7 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 1276188 (view as bug list) Environment:
Last Closed: 2016-11-04 05:00:04 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1276188    
Attachments:
Description Flags
fix patch none

Description JianHong Yin 2015-07-15 03:27:30 UTC
Created attachment 1052169 [details]
fix patch

Description of problem:
exportfs: code defect, when export path length > 986, buffer overflow,
Got a error message:
  exportfs: $path... does not support NFS export

Version-Release number of selected component (if applicable):
all version

How reproducible:
always

Steps to Reproduce:
1. mkdir -p [a long path that length > 986]
2. exportfs -i $path

Actual results:
exportfs: /1_2_3_4_5_6_7_8_9_10_11_12_13_14_15_16_17_18_19_20_21_22_23_24_25_26_27_28_29_30_31_32_33_34_35_36_37_38_39_40_41_42_43_44_45_46_47_48_49_50_51_52_53_54_55_56_57_58_59_60_61_62_63_64_65_66_67_68_69_70_71_72_73_74_75_76_77_78_79_80_81_82_83_84_85_86_87_88/1_2_3_4_5_6_7_8_9_10_11_12_13_14_15_16_17_18_19_20_21_22_23_24_25_26_27_28_29_30_31_32_33_34_35_36_37_38_39_40_41_42_43_44_45_46_47_48_49_50_51_52_53_54_55_56_57_58_59_60_61_62_63_64_65_66_67_68_69_70_71_72_73_74_75_76_77_78_79_80_81_82_83_84_85_86_87_88/1_2_3_4_5_6_7_8_9_10_11_12_13_14_15_16_17_18_19_20_21_22_23_24_25_26_27_28_29_30_31_32_33_34_35_36_37_38_39_40_41_42_43_44_45_46_47_48_49_50_51_52_53_54_55_56_57_58_59_60_61_62_63_64_65_66_67_68_69_70_71_72_73_74_75_76_77_78_79_80_81_82_83_84_85_86_87_88/1_2_3_4_5_6_7_8_9_10_11_12_13_14_15_16_17_18_19_20_21_22_23_24_25_26_27_28_29_30_31_32_33_34_35_36_37_38_39_40_41_42_43_44_45_46_47_48_49_50_51_52_53_54_55_56_57_58_59_60_61_62_63_64_65_66_67_68_69_70_71_72_73_74_75_76_77_78_79_80_81_82_83_84_85_86_87_88/ab does not support NFS export

Expected results:
export success, and no error msg: "does not support NFS export"

Additional info:

Comment 1 JianHong Yin 2015-07-15 04:56:31 UTC
simple test script:

exportfs=${exportfs:-exportfs}

$exportfs -ua

dname=$(echo {1..88}|sed 's/ /_/g'); #254
fpath=/$dname/$dname/$dname/$dname;  #1020
mkdir -p $fpath/ab;                  #1023. # NFS_MAXPATHLEN == 1024
$exportfs -i 127.0.0.1:$fpath/ab;

$exportfs

Comment 4 Steve Dickson 2015-11-03 22:35:53 UTC
(In reply to Yin.JianHong from comment #0)
> Created attachment 1052169 [details]
> fix patch
Would you mind sending this patch upstream at linux-nfs.org

tia!

Comment 6 Steve Dickson 2015-11-05 12:10:38 UTC
commit 67a0768370a54100c77e58f611e1d1fceb93e2c0
Author: Jianhong Yin <jiyin>
Date:   Wed Nov 4 16:28:47 2015 -0500

    exportfs: Fix buf size in test_export() dump()
    
    From: Jianhong Yin <jiyin>
    
    The buf[] size in test_export() is not enough for NFS_MAXPATHLEN
    + prefix/suffix proto string. Fix it and same issue in dump().
    And just to be on the safe side, %s/sprintf/snprintf/
    
    Signed-off-by: Steve Dickson <steved>

Comment 10 Yongcheng Yang 2016-05-18 12:14:15 UTC
Move to VERIFIED as comment 9. Will continue to run the automatic case in the future.

Comment 12 errata-xmlrpc 2016-11-04 05:00:04 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2383.html