From nobody Fri Jan 24 02:31:21 2025 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4YfMJ92NvSz5lpPY; Fri, 24 Jan 2025 02:31:21 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4YfMJ91lDhz43SV; Fri, 24 Jan 2025 02:31:21 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1737685881; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=BoN4HZtV+67st4m3IZknGuXtmuolJPEg3ZP2gCFkvqY=; b=Z/bD9RyQMdxJKqnk65nCWWnO9nFvQoGmjv+84F1JPwWEnEspAjjkyl9VVCutuMWZbF8/j8 QDuMxXc7eJsrNmoV7ihUkIXN0yOJVt/C7yGsxo0Avb1fiEjpK3QYP/OrQxwmoIFalXxJ2B Ma/QeGu0vHZESAN/YnItyqlZyWSFvtDyvJ5ID05QRb+SeYszAdwdF8Bn1hQFsk7jzKsfwc 2dGKvCOONop73Zdxsnkr3kDJtp1rhxAFwLnVX8yh9S5ljI+NKa+mfrVLNM3GdwPv9VSx5n 8CUH7sL1hmoJO2pesHrtIIoMf4Jtd2e2299E7A96vWBPL4DIN2xWP/wR0eccug== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1737685881; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=BoN4HZtV+67st4m3IZknGuXtmuolJPEg3ZP2gCFkvqY=; b=p1pMg0GTvtba2xZAH7j5HK8NWG6Yi1OGGeRe7VrDZbW0HdpDsUXq0g48qWDUyS8JoQwBbo VU+JUtqAuGMJxZlzCLR2itqdXNV4m70LBs/9jFZIiHmelEOS0aRrmBNMR0FEw616QX3nME WWSwj3MV49VKYd5fMKoSeQhLPpwQoGSP3JRHHP3k+cZvNmfzIoDR3ZVicXL9Yr5Zerd3n7 OU4DpTe4zWvg1oLQB0IgPeBPwvK4T05nUVQaAJRxNT30Pw49MeUKAbRR85/CNLxXMf8s9/ Jn//cu7rgOmyInHGB5XmhzSZAbLg3JdV/7SjkcmakrraF2N26DQV/IvfKfa6vg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1737685881; a=rsa-sha256; cv=none; b=LseGrYLslpisWxJ3sq3YEWCj9qqtn2XWSxB2ujJch5XLtJns5GD2e6SC/O3xAqSOJe4M35 aXy+IiuKDxXnG10j8ICfci0nC1i/Rn6n1+SbKEj8p4/QkIWMAZIaaan4+1Y50+YMft6RBY WVCzTAS7XyUNDZrVf9c55QLIL3sfcXjNNqhhnDko2302Qrf6aPjec8l21K8iTt/pKRjOnx /jBEnFWiNTztCFrDL/L5Fq/vTR7qFlh84fRlim5HgV/lyh3P0aFDgaRlf7D2Xyn3oa1ROf lyGf0USmiE4qFZoalw2tckmDng3Clot6p9WiVDu7W8l0GK86Ub/9Lt2o0Ndapg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4YfMJ91Hpxz15P7; Fri, 24 Jan 2025 02:31:21 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 50O2VLZD052426; Fri, 24 Jan 2025 02:31:21 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 50O2VLWq052423; Fri, 24 Jan 2025 02:31:21 GMT (envelope-from git) Date: Fri, 24 Jan 2025 02:31:21 GMT Message-Id: <202501240231.50O2VLWq052423@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Rick Macklem Subject: git: 968abc191ea1 - stable/13 - nfscl: Fix a crash when a readdir entry has nul in it List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: rmacklem X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: 968abc191ea145040f4c2105755d11b63ecb2427 Auto-Submitted: auto-generated The branch stable/13 has been updated by rmacklem: URL: https://cgit.FreeBSD.org/src/commit/?id=968abc191ea145040f4c2105755d11b63ecb2427 commit 968abc191ea145040f4c2105755d11b63ecb2427 Author: Rick Macklem AuthorDate: 2025-01-10 03:54:41 +0000 Commit: Rick Macklem CommitDate: 2025-01-24 02:30:22 +0000 nfscl: Fix a crash when a readdir entry has nul in it Commit 026cdaa3b3a9 added a check for a nul or "/" in a file name in a readdir reply. Unfortunately, the minimal testing done on it did not detect a bug that can cause the client to crash. This patch fixes the code so that it does not crash. Note that a NFS server will not normally return a file name in a readdir reply that has a nul or "/" in it, so the crash is unlikely. PR: 283965 (cherry picked from commit f9f0a1d61c7b97c705246c747baec385e0592966) --- sys/fs/nfsclient/nfs_clrpcops.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/sys/fs/nfsclient/nfs_clrpcops.c b/sys/fs/nfsclient/nfs_clrpcops.c index b3062b5a5d88..f3ab2bda8f85 100644 --- a/sys/fs/nfsclient/nfs_clrpcops.c +++ b/sys/fs/nfsclient/nfs_clrpcops.c @@ -3079,6 +3079,7 @@ nfsrpc_readdir(vnode_t vp, struct uio *uiop, nfsuint64 *cookiep, nfsattrbit_t attrbits, dattrbits; u_int32_t rderr, *tl2 = NULL; size_t tresid; + bool validentry; KASSERT(uiop->uio_iovcnt == 1 && (uiop->uio_resid & (DIRBLKSIZ - 1)) == 0, @@ -3305,6 +3306,7 @@ nfsrpc_readdir(vnode_t vp, struct uio *uiop, nfsuint64 *cookiep, /* loop through the dir entries, doctoring them to 4bsd form */ while (more_dirs && bigenough) { + validentry = true; if (nd->nd_flag & ND_NFSV4) { NFSM_DISSECT(tl, u_int32_t *, 3*NFSX_UNSIGNED); ncookie.lval[0] = *tl++; @@ -3384,6 +3386,7 @@ nfsrpc_readdir(vnode_t vp, struct uio *uiop, nfsuint64 *cookiep, uiop->uio_offset = savoff; uiop->uio_resid = savresid; blksiz = savblksiz; + validentry = false; } else { cp = uiop->uio_iov->iov_base; tlen -= len; @@ -3421,7 +3424,7 @@ nfsrpc_readdir(vnode_t vp, struct uio *uiop, nfsuint64 *cookiep, ncookie.lval[0] = 0; ncookie.lval[1] = *tl++; } - if (bigenough) { + if (bigenough && validentry) { if (nd->nd_flag & ND_NFSV4) { if (rderr) { dp->d_fileno = 0; @@ -3560,7 +3563,7 @@ nfsrpc_readdirplus(vnode_t vp, struct uio *uiop, nfsuint64 *cookiep, size_t tresid; u_int32_t *tl2 = NULL, rderr; struct timespec dctime, ts; - bool attr_ok; + bool attr_ok, validentry; KASSERT(uiop->uio_iovcnt == 1 && (uiop->uio_resid & (DIRBLKSIZ - 1)) == 0, @@ -3771,6 +3774,7 @@ nfsrpc_readdirplus(vnode_t vp, struct uio *uiop, nfsuint64 *cookiep, /* loop through the dir entries, doctoring them to 4bsd form */ while (more_dirs && bigenough) { + validentry = true; NFSM_DISSECT(tl, u_int32_t *, 3 * NFSX_UNSIGNED); if (nd->nd_flag & ND_NFSV4) { ncookie.lval[0] = *tl++; @@ -3846,6 +3850,7 @@ nfsrpc_readdirplus(vnode_t vp, struct uio *uiop, nfsuint64 *cookiep, uiop->uio_offset = savoff; uiop->uio_resid = savresid; blksiz = savblksiz; + validentry = false; } else { cp = uiop->uio_iov->iov_base; tlen -= len; @@ -3902,7 +3907,7 @@ nfsrpc_readdirplus(vnode_t vp, struct uio *uiop, nfsuint64 *cookiep, goto nfsmout; } - if (bigenough) { + if (bigenough && validentry) { if (nd->nd_flag & ND_NFSV4) { if (rderr) { dp->d_fileno = 0;