Subject: Bug#549002: linux-image-2.6.26-2-xen-amd64: Kernel Oops - autofs5 nfs4 mount

From: Ben Hutchings <[email-masked]>
Date: Sun, 04 Oct 2009 14:15:36 +0100

nfs_alloc_client() is copying 48 bytes of IP address string from mount
data to client structure with memcpy(), while the source string is
allocated with strdup() and is normally shorter.  In this case it has
copied 32 bytes (RCX = 4 indicating 16 bytes left to go) and then
overrun into an unmapped page (RSI = ffff8800c7be5000 which is
page-aligned).

This could happen with any NFSv4 mount and is not specific to autofs.

The fix is to use strlcpy() instead of memcpy().

Ben.

-- 
Ben Hutchings
I say we take off; nuke the site from orbit.  It's the only way to be sure.