[PATCH v1] NFSv4.1: reject a minor version 0 CB_COMPOUND on the backchannel

[Chuck Lever <cel@kernel.org>]

nfs4_callback_compound() selects the minor version 0 path from the
CB_COMPOUND header alone. A malicious or broken NFS server can send
a minor version 0 CB_COMPOUND over a session backchannel, where
rq_xprt is NULL. If the NFS client also holds a minor version 0
client ID in the same network namespace, the cb_ident lookup
succeeds and svc_xprt_set_valid() dereferences the NULL rq_xprt.

RFC 8881 Section 19.2.3 requires a CB_COMPOUND to carry the minor
version of the COMPOUND that created the session. Return
NFS4ERR_MINOR_VERS_MISMATCH for a minor version 0 CB_COMPOUND that
arrives on a backchannel.

Fixes: eccbbc7c00a5 ("nfsd: don't use sv_nrthreads in connection limiting calculations.")
Signed-off-by: Chuck Lever <cel@kernel.org>
---
 fs/nfs/callback_xdr.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
index 88e1af0fda01..378eacb5b6a9 100644
--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -951,7 +951,13 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp)
 	if (status == htonl(NFS4ERR_RESOURCE))
 		return rpc_garbage_args;
 
-	if (hdr_arg.minorversion == 0) {
+	if (hdr_arg.minorversion == 0 && svc_is_backchannel(rqstp)) {
+		/* RFC 8881 Section 19.2.3: a backchannel carries only the
+		 * minor version that created its session.
+		 */
+		pr_warn_ratelimited("NFS: NFSv4 backchannel callback with minor version 0\n");
+		status = htonl(NFS4ERR_MINOR_VERS_MISMATCH);
+	} else if (hdr_arg.minorversion == 0) {
 		cps.clp = nfs4_find_client_ident(SVC_NET(rqstp), hdr_arg.cb_ident);
 		if (!cps.clp) {
 			trace_nfs_cb_no_clp(rqstp->rq_xid, hdr_arg.cb_ident);
-- 
2.54.0