[PATCH] nfsd: fix use-after-free of DRC slot in nfsd4_sequence()

[Tien Phan <tienpp@gmail.com>]

nfsd4_sequence() loads the slot addressed by the client-supplied
seq->slotid, bounded only against se_fchannel.maxreqs:

	if (seq->slotid >= session->se_fchannel.maxreqs)
		goto out_put_session;
	slot = xa_load(&session->se_slots, seq->slotid);

When the client acknowledges a slot-count reduction, the handler frees
every slot in [se_target_maxslots, maxreqs):

	if (session->se_target_maxslots < session->se_fchannel.maxreqs &&
	    slot->sl_generation == session->se_slot_gen &&
	    seq->maxslots <= session->se_target_maxslots)
		free_session_slots(session, session->se_target_maxslots);

but never checks that the slot it just loaded lies outside that range.
A malicious NFSv4.1 client can pick seq->slotid >= se_target_maxslots
(still < maxreqs, so the bound above passes) and, once the DRC slot
shrinker has lowered se_target_maxslots below maxreqs, issue two SEQUENCE
calls on that high slot: the first aligns slot->sl_generation with
se_slot_gen, the second satisfies the reduce-ack condition and calls
free_session_slots(), which kfree()s the very slot still referenced by
the handler.  The slot is then written (slot->sl_seqid = seq->seqid,
slot->sl_flags, cstate->slot = slot) and used for DRC caching -- a
use-after-free write.

Reject a slotid that falls within the range about to be freed before
freeing it, so the handler never operates on a freed slot.

Found with an in-tree KASAN harness driving the real free_session_slots()
on a live slot xarray (KASAN: slab-use-after-free, write of size 4).

Fixes: fc8738c68d0b ("nfsd: add support for freeing unused session-DRC slots")
Cc: stable@vger.kernel.org # 6.14+
Signed-off-by: Tien Phan <tienpp@gmail.com>
---
 fs/nfsd/nfs4state.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index a42f34842d77..f737b841b5a2 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -4575,9 +4575,19 @@ nfsd4_sequence(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
 
 	if (session->se_target_maxslots < session->se_fchannel.maxreqs &&
 	    slot->sl_generation == session->se_slot_gen &&
-	    seq->maxslots <= session->se_target_maxslots)
+	    seq->maxslots <= session->se_target_maxslots) {
 		/* Client acknowledged our reduce maxreqs */
+		if (seq->slotid >= session->se_target_maxslots) {
+			/*
+			 * ... but is using a slot from the range we are
+			 * about to free.  Proceeding would leave the code
+			 * below dereferencing a freed slot (use-after-free).
+			 */
+			status = nfserr_badslot;
+			goto out_put_session;
+		}
 		free_session_slots(session, session->se_target_maxslots);
+	}
 
 	buflen = (seq->cachethis) ?
 			session->se_fchannel.maxresp_cached :
-- 
2.34.1