Entry 84 (and a few neighbors) in nfsd4_enc_fattr4_encode_ops[] is
NULL, so if a client sets that bit in an OP_VERIFY bitmask, the server
will crash here in nfsd_encode_fattr4():
for_each_set_bit(bit, attr_bitmap,
ARRAY_SIZE(nfsd4_enc_fattr4_encode_ops)) {
status = nfsd4_enc_fattr4_encode_ops[bit](xdr, &args);
I've attached a demo:
# cc nfsd128b.c
# ./a.out
...
[ 354.732253] BUG: kernel NULL pointer dereference, address: 0000000000000000
[ 354.733355] #PF: supervisor instruction fetch in kernel mode
[ 354.734247] #PF: error_code(0x0010) - not-present page
[ 354.735053] PGD 0 P4D 0
[ 354.735482] Oops: Oops: 0010 [#1] SMP PTI
[ 354.736120] CPU: 2 UID: 0 PID: 1459 Comm: nfsd Not tainted 6.17.0-rc4-00231-gc8ed9b5c02a5 #28 PREEMPT(voluntary)
[ 354.737664] Hardware name: FreeBSD BHYVE/BHYVE, BIOS 14.0 10/17/2021
[ 354.738645] RIP: 0010:0x0
[ 354.739087] Code: Unable to access opcode bytes at 0xffffffffffffffd6.
[ 354.739677] RSP: 0018:ffffa7a380e0fa20 EFLAGS: 00010293
[ 354.739956] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000053
[ 354.740327] RDX: 0000000000000014 RSI: ffffa7a380e0fa78 RDI: ffffa7a380e0fc50
[ 354.740691] RBP: ffffa7a380e0fc28 R08: 0000000000000001 R09: ffffa7a380e0fa68
[ 354.741060] R10: 0000000000000000 R11: 0000000000140000 R12: ffffa7a380e0fc50
[ 354.741432] R13: 0000000000000010 R14: 0000000000000054 R15: ffffa36c03bdba00
[ 354.741802] FS: 0000000000000000(0000) GS:ffffa36fa6c88000(0000) knlGS:0000000000000000
[ 354.742215] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 354.742519] CR2: ffffffffffffffd6 CR3: 00000001885a6003 CR4: 00000000003706f0
[ 354.742887] Call Trace:
[ 354.743030] <TASK>
[ 354.743152] nfsd4_encode_fattr4+0x310/0x6b0
[ 354.743396] nfsd4_encode_fattr_to_buf+0xb8/0xf0
[ 354.743645] ? _nfsd4_verify+0x9a/0x160
[ 354.743861] ? _nfsd4_verify+0xd0/0x160
[ 354.744072] _nfsd4_verify+0xd0/0x160
[ 354.744278] nfsd4_verify+0x9/0x20
[ 354.744466] nfsd4_proc_compound+0x39c/0x720
[ 354.744701] nfsd_dispatch+0xd2/0x210
[ 354.744903] svc_process_common+0x481/0x630
[ 354.745130] ? __pfx_nfsd_dispatch+0x10/0x10
[ 354.745362] svc_process+0x12c/0x1b0
[ 354.745558] svc_recv+0x7d0/0x990
[ 354.745738] ? __pfx_nfsd+0x10/0x10
[ 354.745929] nfsd+0x8a/0xe0
[ 354.746083] kthread+0xf6/0x1f0
[ 354.746260] ? __pfx_kthread+0x10/0x10
[ 354.746464] ret_from_fork+0x80/0xd0
[ 354.746658] ? __pfx_kthread+0x10/0x10
[ 354.746859] ret_from_fork_asm+0x1a/0x30
[ 354.747069] </TASK>
Robert Morris
rtm@xxxxxxx
Attachment:
nfsd128b.c
Description: Binary data
