In fs/nfs/pnfs_nfs.c, nfs4_decode_mp_ds_addr() says:
rlen = xdr_stream_decode_string_dup(xdr, &buf, INET6_ADDRSTRLEN +
IPV6_SCOPE_ID_LEN + 8, gfp_flags);
if (unlikely(rlen < 0))
goto out_free_netid;
/* replace port '.' with '-' */
portstr = strrchr(buf, '.');
If the string in the server's XDR message has zero length, then
xdr_stream_decode_string_dup() will set buf to NULL and return zero.
So strrchr() will be called on a NULL buf.
I've attached a demo that mounts a fake server that generates a bad
response to a GETDEVICEINFO RPC:
# uname -a
Linux ubuntu66 6.17.0-rc4-00231-gc8ed9b5c02a5 #27 SMP PREEMPT_DYNAMIC Fri Sep 5 15:07:50 EDT 2025 x86_64 x86_64 x86_64 GNU/Linux
# cc nfs138a.c
# ./a.out
...
[ 21.187101] BUG: kernel NULL pointer dereference, address: 0000000000000000
[ 21.188210] #PF: supervisor read access in kernel mode
[ 21.189040] #PF: error_code(0x0000) - not-present page
[ 21.189852] PGD 0 P4D 0
[ 21.190284] Oops: Oops: 0000 [#1] SMP PTI
[ 21.190932] CPU: 5 UID: 0 PID: 1456 Comm: a.out Not tainted 6.17.0-rc4-00231-gc8ed9b5c02a5 #27 PREEMPT(voluntary)
[ 21.192512] Hardware name: FreeBSD BHYVE/BHYVE, BIOS 14.0 10/17/2021
[ 21.193224] RIP: 0010:strrchr+0x6/0x20
[ 21.197694] Call Trace:
[ 21.197838] <TASK>
[ 21.197963] nfs4_decode_mp_ds_addr+0x90/0x2a0
[ 21.198209] nfs4_fl_alloc_deviceid_node+0x24d/0x470
[ 21.198484] nfs4_find_get_deviceid+0x29a/0x3f0
[ 21.198734] fl_pnfs_update_layout.constprop.0+0x70/0x160
[ 21.199025] filelayout_pg_init_read+0x73/0xc0
[ 21.199268] __nfs_pageio_add_request+0x18b/0x490
[ 21.199530] ? kmem_cache_alloc_noprof+0x239/0x2f0
[ 21.199799] ? nfs_page_create+0x79/0x140
[ 21.200021] nfs_pageio_add_request+0x22d/0x300
[ 21.200269] ? nfs_put_lock_context+0x24/0x80
[ 21.200516] nfs_read_add_folio+0x13a/0x1e0
[ 21.200744] nfs_readahead+0x136/0x2a0
[ 21.200955] read_pages+0x85/0x1f0
[ 21.201146] ? filemap_add_folio+0x55/0xa0
[ 21.201374] page_cache_ra_unbounded+0x120/0x1b0
[ 21.201628] filemap_get_pages+0x120/0x6a0
[ 21.201856] filemap_read+0xf6/0x3e0
[ 21.202054] nfs_file_read+0x80/0xa0
[ 21.202253] vfs_read+0x250/0x370
[ 21.202447] ksys_read+0x68/0xe0
[ 21.202633] do_syscall_64+0xa4/0x260
Robert Morris, rtm@xxxxxxx
Attachment:
nfs138a.c
Description: Binary data
