git: 64857418bb23 - main - nfsd: Fix handling of RPC messages too large to cache

The branch main has been updated by rmacklem:

URL: https://cgit.FreeBSD.org/src/commit/?id=64857418bb2379a7d89b6af04cddf92fa48dd28c

commit 64857418bb2379a7d89b6af04cddf92fa48dd28c
Author:     Acts1631 <acts1631kjv@proton.me>
AuthorDate: 2026-11-01 23:27:55 +0000
Commit:     Rick Macklem <rmacklem@FreeBSD.org>
CommitDate: 2026-11-01 23:27:55 +0000

    nfsd: Fix handling of RPC messages too large to cache
    
    The NFSv4.1/4.2 session negotiates a limit to the size
    of an RPC reply message that can be cached for the session
    slot.
    
    This patch fixes the code so that it checks that limit and
    does not cache replies larger than the limit, even if the
    client requested that it be cached.
    
    This patch is slightly different than what the author
    submitted, but retains the check for reply cache size limit.
    
    Reviewed by:    rmacklem
    MFC after:      1 month
---
 sys/fs/nfsserver/nfs_nfsdserv.c  | 6 ++++++
 sys/fs/nfsserver/nfs_nfsdstate.c | 4 ++++
 2 files changed, 10 insertions(+)

diff --git a/sys/fs/nfsserver/nfs_nfsdserv.c b/sys/fs/nfsserver/nfs_nfsdserv.c
index 516ac6ab9706..0e0d791ef0e3 100644
--- a/sys/fs/nfsserver/nfs_nfsdserv.c
+++ b/sys/fs/nfsserver/nfs_nfsdserv.c
@@ -4835,7 +4835,13 @@ nfsrvd_createsession(struct nfsrv_descript *nd, __unused int isdgram,
 			printf("Consider increasing kern.ipc.maxsockbuf\n");
 		do_printf = false;
 	}
+	if (sep->sess_maxresp <= NFS_MAXXDR) {
+		nd->nd_repstat = NFSERR_TOOSMALL;
+		goto nfsmout;
+	}
 	sep->sess_maxrespcached = fxdr_unsigned(uint32_t, *tl++);
+	if (sep->sess_maxrespcached > sep->sess_maxresp)
+		sep->sess_maxrespcached = sep->sess_maxresp;
 	sep->sess_maxops = fxdr_unsigned(uint32_t, *tl++);
 	sep->sess_maxslots = fxdr_unsigned(uint32_t, *tl++);
 	if (sep->sess_maxslots > NFSV4_SLOTS)
diff --git a/sys/fs/nfsserver/nfs_nfsdstate.c b/sys/fs/nfsserver/nfs_nfsdstate.c
index 2fdce567c1ce..de0c729acfa6 100644
--- a/sys/fs/nfsserver/nfs_nfsdstate.c
+++ b/sys/fs/nfsserver/nfs_nfsdstate.c
@@ -6222,6 +6222,10 @@ nfsrv_cache_session(struct nfsrv_descript *nd, struct mbuf **m)
 		m_freem(*m);
 		return;
 	}
+	if (*m != NULL && m_length(*m, NULL) > sep->sess_maxrespcached) {
+		m_freem(*m);
+		*m = NULL;
+	}
 	nfsv4_seqsess_cacherep(nd->nd_slotid, sep->sess_slots, nd->nd_repstat,
 	    m);
 	NFSUNLOCKSESSION(shp);