Date: Thu, 09 Dec 2021 17:22:18 +0000 From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 260293] big counts in LAYOUTRETURN can cause NFS v4 nfsrv_flexlayouterr() to page-fault Message-ID: <bug-260293-227@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D260293 Bug ID: 260293 Summary: big counts in LAYOUTRETURN can cause NFS v4 nfsrv_flexlayouterr() to page-fault Product: Base System Version: CURRENT Hardware: Any OS: Any Status: New Severity: Affects Some People Priority: --- Component: kern Assignee: bugs@FreeBSD.org Reporter: rtm@lcs.mit.edu Attachment #229996 text/plain mime type: Created attachment 229996 --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=3D229996&action= =3Dedit Crash an NFS v4 server with a bad LAYOUTRETURN nfsrv_flexlayouterr() uses counts (cnt and errcnt) read from the client's RPC request without a sanity check, which can cause tl to run off the end of the allocated space and eventually cause a page fault. I've attached a demo: # uname -a FreeBSD 14.0-CURRENT FreeBSD 14.0-CURRENT #138 main-n250910-5ebdc4cea5b6-dirty: Thu Dec 9 12:07:05 EST 2021=20=20=20=20 rtm@xxx:/usr/obj/usr/rtm/symbsd/src/riscv.riscv64/sys/RTM riscv # cc fnfsd_11.c # ./a.out ... panic: Fatal page fault at 0xffffffc0001b79d8: 0xffffffd080000005 --- exception 13, tval =3D 0xffffffd080000005 nfsrv_flexlayouterr() at nfsrv_flexlayouterr+0x132 nfsrv_layoutreturn() at nfsrv_layoutreturn+0x3a8 nfsrvd_layoutreturn() at nfsrvd_layoutreturn+0x328 nfsrvd_compound() at nfsrvd_compound+0xdc8 nfsrvd_dorpc() at nfsrvd_dorpc+0x294 nfs_proc() at nfs_proc+0x11a nfssvc_program() at nfssvc_program+0x426 svc_executereq() at svc_executereq+0xa2 svc_run_internal() at svc_run_internal+0x302 svc_run() at svc_run+0x146 nfsrvd_nfsd() at nfsrvd_nfsd+0x194 nfssvc_nfsd() at nfssvc_nfsd+0x300 sys_nfssvc() at sys_nfssvc+0xdc syscallenter() at syscallenter+0xf4 ecall_handler() at ecall_handler+0x18 do_trap_user() at do_trap_user+0xea cpu_exception_handler_user() at cpu_exception_handler_user+0x72 --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-260293-227>