Re: client can crash nfsd4_encode_fattr4() by setting bit 84

[Jeff Layton <jlayton@kernel.org>]

On Wed, 2025-09-10 at 09:55 -0400, rtm@csail.mit.edu wrote:
> Entry 84 (and a few neighbors) in nfsd4_enc_fattr4_encode_ops[] is
> NULL, so if a client sets that bit in an OP_VERIFY bitmask, the server
> will crash here in nfsd_encode_fattr4():
> 
>         for_each_set_bit(bit, attr_bitmap,
>                          ARRAY_SIZE(nfsd4_enc_fattr4_encode_ops)) {
>                 status = nfsd4_enc_fattr4_encode_ops[bit](xdr, &args);

Thanks. That looks like a real bug, alright. I think we just need to
check that nfsd4_enc_fattr4_encode_ops[bit] is non-NULL before calling
its handler.

Care to propose a patch?

> 
> I've attached a demo:
> 
> # cc nfsd128b.c
> # ./a.out
> ...
> [  354.732253] BUG: kernel NULL pointer dereference, address: 0000000000000000
> [  354.733355] #PF: supervisor instruction fetch in kernel mode
> [  354.734247] #PF: error_code(0x0010) - not-present page
> [  354.735053] PGD 0 P4D 0
> [  354.735482] Oops: Oops: 0010 [#1] SMP PTI
> [  354.736120] CPU: 2 UID: 0 PID: 1459 Comm: nfsd Not tainted 6.17.0-rc4-00231-gc8ed9b5c02a5 #28 PREEMPT(voluntary)
> [  354.737664] Hardware name: FreeBSD BHYVE/BHYVE, BIOS 14.0 10/17/2021
> [  354.738645] RIP: 0010:0x0
> [  354.739087] Code: Unable to access opcode bytes at 0xffffffffffffffd6.
> [  354.739677] RSP: 0018:ffffa7a380e0fa20 EFLAGS: 00010293
> [  354.739956] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000053
> [  354.740327] RDX: 0000000000000014 RSI: ffffa7a380e0fa78 RDI: ffffa7a380e0fc50
> [  354.740691] RBP: ffffa7a380e0fc28 R08: 0000000000000001 R09: ffffa7a380e0fa68
> [  354.741060] R10: 0000000000000000 R11: 0000000000140000 R12: ffffa7a380e0fc50
> [  354.741432] R13: 0000000000000010 R14: 0000000000000054 R15: ffffa36c03bdba00
> [  354.741802] FS:  0000000000000000(0000) GS:ffffa36fa6c88000(0000) knlGS:0000000000000000
> [  354.742215] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [  354.742519] CR2: ffffffffffffffd6 CR3: 00000001885a6003 CR4: 00000000003706f0
> [  354.742887] Call Trace:
> [  354.743030]  <TASK>
> [  354.743152]  nfsd4_encode_fattr4+0x310/0x6b0
> [  354.743396]  nfsd4_encode_fattr_to_buf+0xb8/0xf0
> [  354.743645]  ? _nfsd4_verify+0x9a/0x160
> [  354.743861]  ? _nfsd4_verify+0xd0/0x160
> [  354.744072]  _nfsd4_verify+0xd0/0x160
> [  354.744278]  nfsd4_verify+0x9/0x20
> [  354.744466]  nfsd4_proc_compound+0x39c/0x720
> [  354.744701]  nfsd_dispatch+0xd2/0x210
> [  354.744903]  svc_process_common+0x481/0x630
> [  354.745130]  ? __pfx_nfsd_dispatch+0x10/0x10
> [  354.745362]  svc_process+0x12c/0x1b0
> [  354.745558]  svc_recv+0x7d0/0x990
> [  354.745738]  ? __pfx_nfsd+0x10/0x10
> [  354.745929]  nfsd+0x8a/0xe0
> [  354.746083]  kthread+0xf6/0x1f0
> [  354.746260]  ? __pfx_kthread+0x10/0x10
> [  354.746464]  ret_from_fork+0x80/0xd0
> [  354.746658]  ? __pfx_kthread+0x10/0x10
> [  354.746859]  ret_from_fork_asm+0x1a/0x30
> [  354.747069]  </TASK>
> 
> Robert Morris
> rtm@mit.edu

-- 
Jeff Layton <jlayton@kernel.org>