[Bug 260293] big counts in LAYOUTRETURN can cause NFS v4 nfsrv_flexlayouterr() to page-fault

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=260293

            Bug ID: 260293
           Summary: big counts in LAYOUTRETURN can cause NFS v4
                    nfsrv_flexlayouterr() to page-fault
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: rtm@lcs.mit.edu
 Attachment #229996 text/plain
         mime type:

Created attachment 229996
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=229996&action=edit
Crash an NFS v4 server with a bad LAYOUTRETURN

nfsrv_flexlayouterr() uses counts (cnt and errcnt) read from the
client's RPC request without a sanity check, which can cause tl to run
off the end of the allocated space and eventually cause a page fault.

I've attached a demo:

# uname -a
FreeBSD  14.0-CURRENT FreeBSD 14.0-CURRENT #138
main-n250910-5ebdc4cea5b6-dirty: Thu Dec  9 12:07:05 EST 2021    
rtm@xxx:/usr/obj/usr/rtm/symbsd/src/riscv.riscv64/sys/RTM  riscv
# cc fnfsd_11.c
# ./a.out
...
panic: Fatal page fault at 0xffffffc0001b79d8: 0xffffffd080000005
--- exception 13, tval = 0xffffffd080000005
nfsrv_flexlayouterr() at nfsrv_flexlayouterr+0x132
nfsrv_layoutreturn() at nfsrv_layoutreturn+0x3a8
nfsrvd_layoutreturn() at nfsrvd_layoutreturn+0x328
nfsrvd_compound() at nfsrvd_compound+0xdc8
nfsrvd_dorpc() at nfsrvd_dorpc+0x294
nfs_proc() at nfs_proc+0x11a
nfssvc_program() at nfssvc_program+0x426
svc_executereq() at svc_executereq+0xa2
svc_run_internal() at svc_run_internal+0x302
svc_run() at svc_run+0x146
nfsrvd_nfsd() at nfsrvd_nfsd+0x194
nfssvc_nfsd() at nfssvc_nfsd+0x300
sys_nfssvc() at sys_nfssvc+0xdc
syscallenter() at syscallenter+0xf4
ecall_handler() at ecall_handler+0x18
do_trap_user() at do_trap_user+0xea
cpu_exception_handler_user() at cpu_exception_handler_user+0x72

-- 
You are receiving this mail because:
You are the assignee for the bug.