Re: [BUG] nfsd: OP_ILLEGAL indexes beyond spo_must_allow bitmap

[Jeff Layton <jlayton@kernel.org>]

On Wed, 2026-10-28 at 16:03 +0800, Yifan Zhang wrote:
> Hello,
> 
> I found an out-of-bounds bitmap read in nfsd4_spo_must_allow() when an
> NFSv4.1 COMPOUND contains an invalid operation number. I reproduced it on two
> independent boots of an unmodified Linux v7.3 KASAN kernel. Both runs
> reported:
> 
>   BUG: KASAN: slab-out-of-bounds in nfsd4_spo_must_allow+0x2ec/0x4d0
>   Read of size 8 by task nfsd
>   nfsd4_spo_must_allow
>   check_security_flavor
>   check_nfsd_access
>   nfsd4_proc_compound
> 
> nfsd4_decode_compound() converts an out-of-range wire operation to
> OP_ILLEGAL (10044) and retains it in the decoded operation array.
> nfsd4_spo_must_allow() later scans that array and calls test_bit() with the
> operation number without a range check. On x86-64, the two-word
> spo_must_allow bitmap is indexed at word 156.
> 
> The attached C reproducer starts a loopback NFSv4.1 server, creates an
> ordinary fsid=0 export that allows AUTH_SYS, establishes a session with
> AUTH_NULL, and sends:
> 
>   COMPOUND [SEQUENCE, PUTROOTFH, GETFH, 0xffffffff]
> 
> It can be built with:
> 
>   cc -O2 repro.c -o repro
> 
> The trigger is deterministic and runs over loopback on the default syzkaller
> ext4 image.
> 
> CVE-2023-53680 fixed an OP_ILLEGAL index into OPDESC() in the decoder, and
> CVE-2025-38430 added the non-COMPOUND procedure check in
> nfsd4_spo_must_allow(). This report reaches a separate bitmap index from a
> valid NFSv4.1 COMPOUND.
> 
> A minimal fix is to skip operation numbers above LAST_NFS4_OP before calling
> test_bit(). A regression test can use a valid session followed by
> PUTROOTFH, GETFH, and an illegal final opcode.
> 
> Attached are the reproducer, KASAN report, and kernel config.
> 
> Regards,
> Yifan Zhang

I believe this is already fixed in Chuck's nfsd-testing branch in
commit 2ce8ab98091b.
-- 
Jeff Layton <jlayton@kernel.org>