git/linux-net
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/ synced 2026-04-17 22:23:45 -04:00
Code Issues Packages Projects Releases Wiki Activity

NFSD: Never cache a COMPOUND when the SEQUENCE operation fails

Browse Source 
RFC 8881 normatively mandates that operations where the initial
SEQUENCE operation in a compound fails must not modify the slot's
replay cache.

nfsd4_cache_this() doesn't prevent such caching. So when SEQUENCE
fails, cstate.data_offset is not set, allowing
read_bytes_from_xdr_buf() to access uninitialized memory.

Reported-by: rtm@csail.mit.edu
Closes: https://lore.kernel.org/linux-nfs/c3628d57-94ae-48cf-8c9e-49087a28cec9@oracle.com/T/#t
Fixes: 468de9e54a ("nfsd41: expand solo sequence check")
Reviewed-by: NeilBrown <neil@brown.name>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
This commit is contained in:
Chuck Lever
2025-10-16 09:49:56 -04:00
parent ff8141e49c
commit c96573c0d7
1 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
fs/nfsd/nfs4state.c
View File

@@ -3487,7 +3487,20 @@ nfsd4_store_cache_entry(struct nfsd4_compoundres *resp)
struct nfsd4_slot *slot = resp->cstate.slot;
unsigned int base;
dprintk("--> %s slot %p\n", __func__, slot);
/*
* RFC 5661 Section 2.10.6.1.2:
*
* Any time SEQUENCE ... returns an error ... [t]he replier MUST NOT
* modify the reply cache entry for the slot whenever an error is
* returned from SEQUENCE ...
*
* Because nfsd4_store_cache_entry is called only by
* nfsd4_sequence_done(), nfsd4_store_cache_entry() is called only
* when a SEQUENCE operation was part of the COMPOUND.
* nfs41_check_op_ordering() ensures SEQUENCE is the first op.
*/
if (resp->opcnt == 1 && resp->cstate.status != nfs_ok)
return;
slot->sl_flags |= NFSD4_SLOT_INITIALIZED;
slot->sl_opcnt = resp->opcnt;