nfsd: validate sockaddr length per family in listener_set

nfsd_sock_nl_policy declares NFSD_A_SOCK_ADDR as bare NLA_BINARY with no minimum length. A CAP_NET_ADMIN caller can send a 16-byte NFSD_A_SOCK_ADDR with sa_family=AF_INET6, causing a 12-byte OOB read across three consumers (rpc_cmp_addr_port, svc_find_listener, kernel_bind).

Tighten the policy to NLA_POLICY_MIN_LEN(16) so that nla_parse_nested() rejects anything shorter than a struct sockaddr, and add per-family length validation in both nlmsg_for_each_attr_type loops to cover the larger struct sockaddr_in6. The new policy floor subsumes the open-coded "nla_len < sizeof(struct sockaddr)" check, so drop it from both loops.

In the listener-creation loop, report the error rather than silently succeeding. Previously an unsupported family reached svc_xprt_create_from_sa(), which returned -EAFNOSUPPORT to userspace; simply skipping the malformed attribute would instead return 0. Set -EAFNOSUPPORT for unsupported families and -EINVAL for a too-short address before continuing, so userspace still sees the failure.

---
This version fixes the error handling so that an invalid address passed from userland will properly cause a -EINVAL return.

---
 Documentation/netlink/specs/nfsd.yaml |  4 ++++
 fs/nfsd/netlink.c                     |  2 +-
 fs/nfsd/nfsctl.c                      | 41 ++++++++++++++++++++++++++++++-----
 3 files changed, 40 insertions(+), 7 deletions(-)

index 8f36fadd68f7..9677ba19ffcd 100644
@@ -156,6 +156,10 @@ attribute-sets:
       -
         name: addr
         type: binary
+        # 16 == sizeof(struct sockaddr_in); AF_INET6 callers
+        # validate the full sockaddr_in6 length in nfsctl.c.
+        checks:
+          min-len: 16
       -
         name: transport-name
         type: string

index fbee3676d253..6570960034f1 100644
@@ -37,7 +37,7 @@ const struct nla_policy nfsd_fslocations_nl_policy[NFSD_A_FSLOCATIONS_LOCATION +
 };
 
 const struct nla_policy nfsd_sock_nl_policy[NFSD_A_SOCK_TRANSPORT_NAME + 1] = {
-	[NFSD_A_SOCK_ADDR] = { .type = NLA_BINARY, },
+	[NFSD_A_SOCK_ADDR] = NLA_POLICY_MIN_LEN(16),
 	[NFSD_A_SOCK_TRANSPORT_NAME] = { .type = NLA_NUL_STRING, },
 };
 

---
base-commit: 332e2f4f37b213f231be1ab5ddc17e2052383b60
change-id: 20260608-nfsd-testing-688a82433c50

Best regards,

Jeff Layton <[email protected]>