[rpms/nfs-utils] f44: Upstream updates

[rpms/nfs-utils] f44: Upstream updates

[Steve Dickson]

            A new commit has been pushed.

            Repo   : rpms/nfs-utils
            Branch : f44
            Commit : edbf7eca7d4893316b0cedfa08ff46700511b752
            Author : Steve Dickson <steved@redhat.com>
            Date   : 2026-08-15T16:16:30-04:00
            Stats  : +152/-1 in 5 file(s)
            URL    : https://src.fedoraproject.org/rpms/nfs-utils/c/edbf7eca7d4893316b0cedfa08ff46700511b752?branch=f44

            Log:
            Upstream updates

- nfsd: fix memory overflow for haddr
- gssd: fix memory leak in gssd_free_client
- statd: fix memory leak in sm_mon_1_svc() when existing host re-monitors
- getport: fix missing stddef.h inclusion

Signed-off-by: Steve Dickson <steved@redhat.com>

---
diff --git a/nfs-utils-2.8.7-gssd-memory-overflow.patch b/nfs-utils-2.8.7-gssd-memory-overflow.patch
new file mode 100644
index 0000000..0849dd4
--- /dev/null
+++ b/nfs-utils-2.8.7-gssd-memory-overflow.patch
@@ -0,0 +1,53 @@
+commit d8752efc0de4a0a48ee716dd4b7b15cf7578cc9d
+Author: zhangjian <zhangjian496@huawei.com>
+Date:   Tue Jul 21 11:51:23 2026 -0400
+
+    gssd: fix memory leak in gssd_free_client
+    
+    clp->servername is always not null, so upcall_* is never free.
+    
+    Signed-off-by: zhangjian <zhangjian496@huawei.com>
+    Signed-off-by: Steve Dickson <steved@redhat.com>
+
+diff --git a/utils/gssd/gssd.c b/utils/gssd/gssd.c
+index 1c901991..bad92321 100644
+--- a/utils/gssd/gssd.c
++++ b/utils/gssd/gssd.c
+@@ -360,6 +360,10 @@ gssd_read_service_info(int dirfd, struct clnt_info *clp)
+ 	clp->prog = program;
+ 	clp->vers = version;
+ 	clp->protocol = protoname;
++	clp->upcall_address = NULL;
++	clp->upcall_port = NULL;
++	clp->upcall_protoname = NULL;
++	clp->upcall_service = NULL;
+ 
+ 	goto out;
+ 
+@@ -414,16 +418,16 @@ gssd_free_client(struct clnt_info *clp)
+ 	free(clp->servicename);
+ 	free(clp->servername);
+ 	free(clp->protocol);
+-	if (!clp->servername) {
+-		if (clp->upcall_address)
+-			free(clp->upcall_address);
+-		if (clp->upcall_port)
+-			free(clp->upcall_port);
+-		if (clp->upcall_protoname)
+-			free(clp->upcall_protoname);
+-		if (clp->upcall_service)
+-			free(clp->upcall_service);
+-	}
++
++	if (clp->upcall_address)
++		free(clp->upcall_address);
++	if (clp->upcall_port)
++		free(clp->upcall_port);
++	if (clp->upcall_protoname)
++		free(clp->upcall_protoname);
++	if (clp->upcall_service)
++		free(clp->upcall_service);
++
+ 	free(clp);
+ }
+ 

diff --git a/nfs-utils-2.8.7-gssd-nfsd-overflow.patch b/nfs-utils-2.8.7-gssd-nfsd-overflow.patch
new file mode 100644
index 0000000..1c18055
--- /dev/null
+++ b/nfs-utils-2.8.7-gssd-nfsd-overflow.patch
@@ -0,0 +1,27 @@
+commit 3665d94cc925a80e96ab9115965bfaf2b534de0a
+Author: zhangjian <zhangjian496@huawei.com>
+Date:   Tue Jul 21 11:53:32 2026 -0400
+
+    nfsd: fix memory overflow for haddr
+    
+    when hcounter is not 0, haddr memory is not enough.
+    asan report heap-buffer-overflow error in following scene:
+    CFLAGS="-fsanitize=address -g" ./configure && make
+    ./utils/nfsd/nfsd -H 192.168.1.1 -H 192.168.1.2
+    
+    Signed-off-by: zhangjian <zhangjian496@huawei.com>
+    Signed-off-by: Steve Dickson <steved@redhat.com>
+
+diff --git a/utils/nfsd/nfsd.c b/utils/nfsd/nfsd.c
+index c95d32f4..e3fcdde4 100644
+--- a/utils/nfsd/nfsd.c
++++ b/utils/nfsd/nfsd.c
+@@ -185,7 +185,7 @@ main(int argc, char **argv)
+ 				hcounter = 0;
+ 			}
+ 			if (hcounter) {
+-				haddr = realloc(haddr, sizeof(char*) * hcounter+1);
++				haddr = realloc(haddr, sizeof(char*) * (hcounter+1));
+ 				if(!haddr) {
+ 					fprintf(stderr, "%s: unable to allocate "
+ 							"memory.\n", progname);

diff --git a/nfs-utils-2.8.7-statd-memory-leak.patch b/nfs-utils-2.8.7-statd-memory-leak.patch
new file mode 100644
index 0000000..ecbcfe0
--- /dev/null
+++ b/nfs-utils-2.8.7-statd-memory-leak.patch
@@ -0,0 +1,33 @@
+commit cf80edaeb9b120b7a533e0d3aea2f05cfcab85ae
+Author: xuchenchen <xuchenchen@kylinos.cn>
+Date:   Sat Aug 15 13:58:16 2026 -0400
+
+    statd: fix memory leak in sm_mon_1_svc() when existing host re-monitors
+    
+    When an already-monitored host sends a new SM_MON request with a
+    different priv cookie, the code sets existing=1 and reuses the
+    existing notify_list entry. However, clnt->dns_name is overwritten
+    with the newly allocated dnsname without freeing the old value,
+    causing a memory leak.
+    
+    Since statd is a long-running daemon, repeated SM_MON requests with
+    changing cookies will accumulate leaked strings.
+    
+    Fix by freeing the old dns_name before overwriting it.
+    
+    Signed-off-by: xuchenchen <xuchenchen@kylinos.cn>
+    Signed-off-by: Steve Dickson <steved@redhat.com>
+
+diff --git a/utils/statd/monitor.c b/utils/statd/monitor.c
+index c76589ca..76ef16f1 100644
+--- a/utils/statd/monitor.c
++++ b/utils/statd/monitor.c
+@@ -187,6 +187,8 @@ sm_mon_1_svc(struct mon *argp, struct svc_req *rqstp)
+ 	NL_MY_VERS(clnt) = id->my_vers;
+ 	NL_MY_PROC(clnt) = id->my_proc;
+ 	memcpy(NL_PRIV(clnt), argp->priv, SM_PRIV_SIZE);
++	if (existing)
++		free(clnt->dns_name);
+ 	clnt->dns_name = dnsname;
+ 
+ 	/*

diff --git a/nfs-utils.spec b/nfs-utils.spec
index 40f7b67..4dbd608 100644
--- a/nfs-utils.spec
+++ b/nfs-utils.spec
@@ -2,7 +2,7 @@ Summary: NFS utilities and supporting clients and daemons for the kernel NFS ser
 Name: nfs-utils
 URL: http://linux-nfs.org/
 Version: 2.8.7
-Release: 6%{?dist}
+Release: 7%{?dist}
 Epoch: 1
 
 # group all 32bit related archs
@@ -22,6 +22,11 @@ Patch004: nfs-utils-2.8.7-getport-warning.patch
 Patch005: nfs-utils-2.8.7-nfsd-thread-count-zero.patch
 Patch006: nfs-utils-2.8.7-gssd-pthread.patch
 Patch007: nfs-utils-2.8.7-export-ignore-hosts.patch
+Patch008: nfs-utils-2.8.7-gssd-memory-overflow.patch
+Patch009: nfs-utils-2.8.7-gssd-nfsd-overflow.patch
+Patch010: nfs-utils-2.8.7-statd-memory-leak.patch
+Patch011: nfsutils-2.8.7-getport-def.patch
+
 
 Patch100: nfs-utils-1.2.1-statdpath-man.patch
 Patch102: nfs-utils-1.2.5-idmap-errmsg.patch
@@ -482,6 +487,12 @@ rm -f %{_sysconfdir}/nfsmount.conf.d/10-nfsv4.conf
 %{_mandir}/*/rpcctl.8.gz
 
 %changelog
+* Sat Aug 15 2026 Steve Dickson <steved@redhat.com> 2.8.7-7
+- nfsd: fix memory overflow for haddr
+- gssd: fix memory leak in gssd_free_client
+- statd: fix memory leak in sm_mon_1_svc() when existing host re-monitors
+- getport: fix missing stddef.h inclusion
+
 * Wed Jul 15 2026 Steve Dickson <steved@redhat.com> 2.8.7-6
 - rpc.gssd: Decrement client referece count on error paths
 - Pass ignore_hosts to export_create() in export_read()

diff --git a/nfsutils-2.8.7-getport-def.patch b/nfsutils-2.8.7-getport-def.patch
new file mode 100644
index 0000000..978587f
--- /dev/null
+++ b/nfsutils-2.8.7-getport-def.patch
@@ -0,0 +1,27 @@
+commit cec8eeb69dc65eb91e0cb23ebff23530d9397425
+Author: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
+Date:   Sat Aug 15 14:00:36 2026 -0400
+
+    getport: fix missing stddef.h inclusion
+    
+    getport.c uses offsetof() but does not include <stddef.h>. On glibc
+    this works because offsetof is pulled in transitively, but on musl it
+    is not available without the explicit include, causing:
+    
+      getport.c:459:41: error: implicit declaration of function 'offsetof'
+    
+    Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
+    Signed-off-by: Steve Dickson <steved@redhat.com>
+
+diff --git a/support/nfs/getport.c b/support/nfs/getport.c
+index 608e185b..6bd2f713 100644
+--- a/support/nfs/getport.c
++++ b/support/nfs/getport.c
+@@ -27,6 +27,7 @@
+ #endif
+ 
+ #include <sys/types.h>
++#include <stddef.h>
+ #include <sys/time.h>
+ #include <unistd.h>
+ #include <fcntl.h>