From: Trond Myklebust Date: Mon, 10 Nov 2025 11:26:03 -0500 Subject: mountd: Minor refactor of get_rootfh() Git-repo: git://git.linux-nfs.org/projects/steved/nfs-utils.git Git-commit: 7e8b36522f58657359c6842119fc516c6dd1baa4 References: CVE-2025-12801 bsc#1259204 Perform the mountpoint checks before checking the user path. Reviewed-by: Jeff Layton Signed-off-by: Trond Myklebust Signed-off-by: Steve Dickson Acked-by: Anthony Iliopoulos --- utils/mountd/mountd.c | 34 +++++++++++++++++----------------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/utils/mountd/mountd.c b/utils/mountd/mountd.c index dbd5546df61c..39afd4aa1ea0 100644 --- a/utils/mountd/mountd.c +++ b/utils/mountd/mountd.c @@ -412,6 +412,23 @@ get_rootfh(struct svc_req *rqstp, dirpath *path, nfs_export **expret, *error = MNT3ERR_ACCES; return NULL; } + if (nfsd_path_stat(exp->m_export.e_path, &estb) < 0) { + xlog(L_WARNING, "can't stat export point %s: %s", + p, strerror(errno)); + *error = MNT3ERR_NOENT; + return NULL; + } + if (exp->m_export.e_mountpoint && + !check_is_mountpoint(exp->m_export.e_mountpoint[0]? + exp->m_export.e_mountpoint: + exp->m_export.e_path, + nfsd_path_lstat)) { + xlog(L_WARNING, "request to export an unmounted filesystem: %s", + p); + *error = MNT3ERR_NOENT; + return NULL; + } + if (nfsd_path_stat(p, &stb) < 0) { xlog(L_WARNING, "can't stat exported dir %s: %s", p, strerror(errno)); @@ -426,12 +443,6 @@ get_rootfh(struct svc_req *rqstp, dirpath *path, nfs_export **expret, *error = MNT3ERR_NOTDIR; return NULL; } - if (nfsd_path_stat(exp->m_export.e_path, &estb) < 0) { - xlog(L_WARNING, "can't stat export point %s: %s", - p, strerror(errno)); - *error = MNT3ERR_NOENT; - return NULL; - } if (estb.st_dev != stb.st_dev && !(exp->m_export.e_flags & NFSEXP_CROSSMOUNT)) { xlog(L_WARNING, "request to export directory %s below nearest filesystem %s", @@ -439,17 +450,6 @@ get_rootfh(struct svc_req *rqstp, dirpath *path, nfs_export **expret, *error = MNT3ERR_ACCES; return NULL; } - if (exp->m_export.e_mountpoint && - !check_is_mountpoint(exp->m_export.e_mountpoint[0]? - exp->m_export.e_mountpoint: - exp->m_export.e_path, - nfsd_path_lstat)) { - xlog(L_WARNING, "request to export an unmounted filesystem: %s", - p); - *error = MNT3ERR_NOENT; - return NULL; - } - /* This will be a static private nfs_export with just one * address. We feed it to kernel then extract the filehandle, */