nfs-utils-3.1.1

[Bruce Dubbs]

New major version.

[Bruce Dubbs]

From nfs-utils-3.1.1-Changelog

Memory-safety and hardening fixes

• junction: use-after-free in locations_to_fslocdata() (dangling pointer after freeing root_path), and a buffer over-read in junction_parse_xml_read() from treating an unterminated xattr buffer as a string.

• gssd: stack buffer overflow in find_keytab_entry() from an unbounded strcpy() of a kernel-supplied hostname (now uses snprintf() with truncation rejection); use of uninitialized heap memory in an error message.

• idmapd: out-of-bounds read validating NAMETOID names when the input lacks a NUL terminator.

• mount: out-of-bounds buffer indexing from mishandling snprintf()'s return value in error formatting.

• mountd: heap corruption in create_junction_exportent() from an unbounded strcpy() of a junction path (now rejects overlong paths) — reachable only via a trusted xattr set by server root, so a hardening fix rather than a remote issue.

• nfsdctl: a heap buffer overflow in autostart_func()'s listener cleanup (undersized calloc() combined with a mismatched loop bound), plus a one-element-past-array write in listener-table insertion, and unchecked netlink attribute writes that silently truncated listener data.

• fsidd: replaced assert()-based input parsing (which could abort the daemon on malformed input) with explicit error handling; added a SO_PEERCRED check so only root can connect to its abstract socket (previously any local user could issue mutating commands and grow its database unbounded).

• blkmapd: rejects zero-length signature components that could cause mapping to an unintended device.

Memory leak fixes: statd (notify_list struct leak, dns_name leak on re-monitor), gssd (thread cleanup on shutdown, upcall_* fields leaked on re-read of service info).

mountd netlink/export-handling rework (largest block of changes, by Jeff Layton): a series of fixes so the newer netlink-based export downcall handles edge cases already handled by the older pipefs path — deferring requests instead of wrongly denying them, retrying rejected batches entry-by-entry, avoiding fsid aliasing on crossmnt submounts, bounding retry queues, giving each worker its own netlink socket to prevent cross-worker reply confusion, and adding kernel-driven rpcbind registration support.

Other: usage()/man page documentation fixes for statd and gssd options, a build fix for --disable-nfsdctl, a missing <stddef.h> include, a Python 3.14 SyntaxWarning fix in rpcctl, and an old-compiler compatibility fix in getport.c.

[Bruce Dubbs]

Fixed at commits:

5edb9dc652 Update to nfs-utils-3.1.1.
6ea7f02b86 Update to HTML-Parser-3.86 (Perl module).
0383305b27 Update to stunnel-5.82.