From nobody Fri Jan 24 02:26:24 2025 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4YfMBS4hZ0z5lpKL; Fri, 24 Jan 2025 02:26:24 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4YfMBS3nDBz42N5; Fri, 24 Jan 2025 02:26:24 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1737685584; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=aPXzsgq5VeWSzxrGS1Q2aKgzwxUxU20/pL6NIp/BfDc=; b=WgAnTQF/IHgTXAFKVdqjzHyfJXKUdk7/4vrZOqIq9GZuFWTDUuxyv7Z7lNFLMoBzsVpgzb L8xqtqwlXv+gULpLMS1X2t+14c0oDnADCBsItguBeO88fQ91uXI85Vg85NL4FGt4Mrwdu8 D8Yb4OO++zRRXp8FwpDb18dCstFRlml+orkbdxY9Q2iF1JOAI1Qp7IY1PEi64/rQXuqOOu H5cnrvnUhkajScKNkjaGXJlLAarBhzTmwK1xVKfGItw91WXfSvLiKq/UWnQQG3xX+grLyw Txm1uqxFgjIK7Z6EWahwARE0W5XEZFfOHfItgnH9nK//heFOGjVfpp1ncrXbNw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1737685584; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=aPXzsgq5VeWSzxrGS1Q2aKgzwxUxU20/pL6NIp/BfDc=; b=B9N4EUyAQLDwsdBEIAyNvqBuBzTozLLpmQovuXnKF4PFhsqKxD0hldCRwG12yHhyM9oNZJ OMuCRYE7P0u+GUTR52rmj2HFsdx6JK4vFzw13Qp0bRy3ensy+mEd3UZ1cpr1A1jObT5Dtr xCMEc5+kN4dwAibeEF2lRaDbCMubiKwinc2rZbJqYzfbeip8NGZd1AB+/T8tGJQdTU3D/D BfGm5dzvZQinXQW2HBhRwtyEEDmgIrPhwpkwfbx5J1LtJGOscmxxPeYJacVW9MJ2gTsO4U +23txDfG2rt5ltWOF38h8jsBxnQjK80kXa1eO0AO7eTTyx6Zd0nlCpApnKBHGw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1737685584; a=rsa-sha256; cv=none; b=o0sf8cK7DUCvqTPyGQkE+enAnftE86VyQ23EkP8l+bP5L9HfVPPmaDac4v5/VYyLiNIe0L SxYGDYypOGOGWJc6hPwRm7S+SF/zxTXVu+KRYRXDyUEnAulLCD3BUCRztTqtLylQ2oNuMS cP/3bvR0kicF7yVU4uERppN7SldXZBrM/KIHLUCeyCtzOfHmjoRraaVxxTKEgYMpp6PWrv fIpyE/9K4jyKd4Dhon9LWjRdLF+OTk6RXQNsvNZgpqg4ny0YqjWSa+MnuNLEeZdsFKNiG+ 8UzbC2UKRGGyGMME4iwLsfpalCpwAVZical7XyAgGIr/GccrrgxOerM1RZ62Dw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4YfMBS2gt4z154X; Fri, 24 Jan 2025 02:26:24 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 50O2QOqs036903; Fri, 24 Jan 2025 02:26:24 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 50O2QOcN036900; Fri, 24 Jan 2025 02:26:24 GMT (envelope-from git) Date: Fri, 24 Jan 2025 02:26:24 GMT Message-Id: <202501240226.50O2QOcN036900@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Rick Macklem Subject: git: d7b69bb536f7 - stable/14 - nfscl: Fix a crash when a readdir entry has nul in it List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: rmacklem X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: d7b69bb536f7dd4857f1aec86536737a2e94c68a Auto-Submitted: auto-generated The branch stable/14 has been updated by rmacklem: URL: https://cgit.FreeBSD.org/src/commit/?id=d7b69bb536f7dd4857f1aec86536737a2e94c68a commit d7b69bb536f7dd4857f1aec86536737a2e94c68a Author: Rick Macklem AuthorDate: 2025-01-10 03:54:41 +0000 Commit: Rick Macklem CommitDate: 2025-01-24 02:25:10 +0000 nfscl: Fix a crash when a readdir entry has nul in it Commit 026cdaa3b3a9 added a check for a nul or "/" in a file name in a readdir reply. Unfortunately, the minimal testing done on it did not detect a bug that can cause the client to crash. This patch fixes the code so that it does not crash. Note that a NFS server will not normally return a file name in a readdir reply that has a nul or "/" in it, so the crash is unlikely. PR: 283965 (cherry picked from commit f9f0a1d61c7b97c705246c747baec385e0592966) --- sys/fs/nfsclient/nfs_clrpcops.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/sys/fs/nfsclient/nfs_clrpcops.c b/sys/fs/nfsclient/nfs_clrpcops.c index 7540893ce63c..76aa3b102962 100644 --- a/sys/fs/nfsclient/nfs_clrpcops.c +++ b/sys/fs/nfsclient/nfs_clrpcops.c @@ -3397,6 +3397,7 @@ nfsrpc_readdir(vnode_t vp, struct uio *uiop, nfsuint64 *cookiep, nfsattrbit_t attrbits, dattrbits; u_int32_t rderr, *tl2 = NULL; size_t tresid; + bool validentry; KASSERT(uiop->uio_iovcnt == 1 && (uiop->uio_resid & (DIRBLKSIZ - 1)) == 0, @@ -3622,6 +3623,7 @@ nfsrpc_readdir(vnode_t vp, struct uio *uiop, nfsuint64 *cookiep, /* loop through the dir entries, doctoring them to 4bsd form */ while (more_dirs && bigenough) { + validentry = true; if (nd->nd_flag & ND_NFSV4) { NFSM_DISSECT(tl, u_int32_t *, 3*NFSX_UNSIGNED); ncookie.lval[0] = *tl++; @@ -3701,6 +3703,7 @@ nfsrpc_readdir(vnode_t vp, struct uio *uiop, nfsuint64 *cookiep, uiop->uio_offset = savoff; uiop->uio_resid = savresid; blksiz = savblksiz; + validentry = false; } else { cp = uiop->uio_iov->iov_base; tlen -= len; @@ -3738,7 +3741,7 @@ nfsrpc_readdir(vnode_t vp, struct uio *uiop, nfsuint64 *cookiep, ncookie.lval[0] = 0; ncookie.lval[1] = *tl++; } - if (bigenough) { + if (bigenough && validentry) { if (nd->nd_flag & ND_NFSV4) { if (rderr) { dp->d_fileno = 0; @@ -3875,7 +3878,7 @@ nfsrpc_readdirplus(vnode_t vp, struct uio *uiop, nfsuint64 *cookiep, size_t tresid; u_int32_t *tl2 = NULL, rderr; struct timespec dctime, ts; - bool attr_ok; + bool attr_ok, validentry; KASSERT(uiop->uio_iovcnt == 1 && (uiop->uio_resid & (DIRBLKSIZ - 1)) == 0, @@ -4086,6 +4089,7 @@ nfsrpc_readdirplus(vnode_t vp, struct uio *uiop, nfsuint64 *cookiep, /* loop through the dir entries, doctoring them to 4bsd form */ while (more_dirs && bigenough) { + validentry = true; NFSM_DISSECT(tl, u_int32_t *, 3 * NFSX_UNSIGNED); if (nd->nd_flag & ND_NFSV4) { ncookie.lval[0] = *tl++; @@ -4161,6 +4165,7 @@ nfsrpc_readdirplus(vnode_t vp, struct uio *uiop, nfsuint64 *cookiep, uiop->uio_offset = savoff; uiop->uio_resid = savresid; blksiz = savblksiz; + validentry = false; } else { cp = uiop->uio_iov->iov_base; tlen -= len; @@ -4217,7 +4222,7 @@ nfsrpc_readdirplus(vnode_t vp, struct uio *uiop, nfsuint64 *cookiep, goto nfsmout; } - if (bigenough) { + if (bigenough && validentry) { if (nd->nd_flag & ND_NFSV4) { if (rderr) { dp->d_fileno = 0;