[PATCH 2/2] fs: nfs: fix NULL dereference in nfs_read_req on truncated packets

Sascha Hauer
2026-04-02T07:55:59Z

nfs_read_req() reads the data length (rlen) from the server's READ3res
response and uses it to extract the payload via nfs_packet_read(). If a
malicious server sends an rlen larger than the remaining packet data,
nfs_packet_read() returns NULL. The subsequent kfifo_put() with a NULL
source pointer causes a NULL pointer dereference.

Add a NULL check after nfs_packet_read() to catch truncated responses.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
fs/nfs.c | 4 ++++
1 file changed, 4 insertions(+)

diff --git a/fs/nfs.c b/fs/nfs.c
index edc15e0ce6..d42ef6bc86 100644
--- a/fs/nfs.c
+++ b/fs/nfs.c
@@ -1194,6 +1194,10 @@ static int nfs_read_req(struct file_priv *priv, uint64_t offset,
}

p = nfs_packet_read(nfs_packet, rlen);
+ if (!p) {
+ ret = -EINVAL;
+ goto err_free_packet;
+ }

kfifo_put(priv->fifo, (char *)p, rlen);

--
2.47.3