Bug 1243234 - exportfs: code defect, when export path length > 986, buffer overflow.
Summary: exportfs: code defect, when export path length > 986, buffer overflow.
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: nfs-utils
Version: 7.2
Hardware: All
OS: Linux
Target Milestone: rc
: ---
Assignee: Steve Dickson
QA Contact: Yongcheng Yang
Depends On:
Blocks: 1276188
TreeView+ depends on / blocked
Reported: 2015-07-15 03:27 UTC by JianHong Yin
Modified: 2016-11-04 05:00 UTC (History)
3 users (show)

Fixed In Version: nfs-utils-1.3.0-0.25.el7
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 1276188 (view as bug list)
Last Closed: 2016-11-04 05:00:04 UTC
Target Upstream Version:

Attachments (Terms of Use)
fix patch (1.92 KB, patch)
2015-07-15 03:27 UTC, JianHong Yin
no flags Details | Diff

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2016:2383 0 normal SHIPPED_LIVE nfs-utils bug fix and enhancement update 2016-11-03 13:53:02 UTC

Description JianHong Yin 2015-07-15 03:27:30 UTC
Created attachment 1052169 [details]
fix patch

Description of problem:
exportfs: code defect, when export path length > 986, buffer overflow,
Got a error message:
  exportfs: $path... does not support NFS export

Version-Release number of selected component (if applicable):
all version

How reproducible:

Steps to Reproduce:
1. mkdir -p [a long path that length > 986]
2. exportfs -i $path

Actual results:
exportfs: /1_2_3_4_5_6_7_8_9_10_11_12_13_14_15_16_17_18_19_20_21_22_23_24_25_26_27_28_29_30_31_32_33_34_35_36_37_38_39_40_41_42_43_44_45_46_47_48_49_50_51_52_53_54_55_56_57_58_59_60_61_62_63_64_65_66_67_68_69_70_71_72_73_74_75_76_77_78_79_80_81_82_83_84_85_86_87_88/1_2_3_4_5_6_7_8_9_10_11_12_13_14_15_16_17_18_19_20_21_22_23_24_25_26_27_28_29_30_31_32_33_34_35_36_37_38_39_40_41_42_43_44_45_46_47_48_49_50_51_52_53_54_55_56_57_58_59_60_61_62_63_64_65_66_67_68_69_70_71_72_73_74_75_76_77_78_79_80_81_82_83_84_85_86_87_88/1_2_3_4_5_6_7_8_9_10_11_12_13_14_15_16_17_18_19_20_21_22_23_24_25_26_27_28_29_30_31_32_33_34_35_36_37_38_39_40_41_42_43_44_45_46_47_48_49_50_51_52_53_54_55_56_57_58_59_60_61_62_63_64_65_66_67_68_69_70_71_72_73_74_75_76_77_78_79_80_81_82_83_84_85_86_87_88/1_2_3_4_5_6_7_8_9_10_11_12_13_14_15_16_17_18_19_20_21_22_23_24_25_26_27_28_29_30_31_32_33_34_35_36_37_38_39_40_41_42_43_44_45_46_47_48_49_50_51_52_53_54_55_56_57_58_59_60_61_62_63_64_65_66_67_68_69_70_71_72_73_74_75_76_77_78_79_80_81_82_83_84_85_86_87_88/ab does not support NFS export

Expected results:
export success, and no error msg: "does not support NFS export"

Additional info:

Comment 1 JianHong Yin 2015-07-15 04:56:31 UTC
simple test script:


$exportfs -ua

dname=$(echo {1..88}|sed 's/ /_/g'); #254
fpath=/$dname/$dname/$dname/$dname;  #1020
mkdir -p $fpath/ab;                  #1023. # NFS_MAXPATHLEN == 1024
$exportfs -i$fpath/ab;


Comment 4 Steve Dickson 2015-11-03 22:35:53 UTC
(In reply to Yin.JianHong from comment #0)
> Created attachment 1052169 [details]
> fix patch
Would you mind sending this patch upstream at linux-nfs@vger.kernel.org


Comment 6 Steve Dickson 2015-11-05 12:10:38 UTC
commit 67a0768370a54100c77e58f611e1d1fceb93e2c0
Author: Jianhong Yin <jiyin@redhat.com>
Date:   Wed Nov 4 16:28:47 2015 -0500

    exportfs: Fix buf size in test_export() dump()
    From: Jianhong Yin <jiyin@redhat.com>
    The buf[] size in test_export() is not enough for NFS_MAXPATHLEN
    + prefix/suffix proto string. Fix it and same issue in dump().
    And just to be on the safe side, %s/sprintf/snprintf/
    Signed-off-by: Steve Dickson <steved@redhat.com>

Comment 10 Yongcheng Yang 2016-05-18 12:14:15 UTC
Move to VERIFIED as comment 9. Will continue to run the automatic case in the future.

Comment 12 errata-xmlrpc 2016-11-04 05:00:04 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.