From nobody Fri Jan 10 03:56:12 2025 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4YTnrX3w0Dz5kds1; Fri, 10 Jan 2025 03:56:12 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4YTnrX2tRDz4Tjx; Fri, 10 Jan 2025 03:56:12 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1736481372; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=v5pktHVLP3+TTchPIRdKmSH46N+d7bDMVLBGmMFhqQo=; b=pSnNWJnHUtBM/Zj23BdGZrnMRZvCixE5Zgbme0SKHZ2YvWM2p0C5vIx7IhZSWdi+fxznNo q/eamwVAi74/WjjtcOHWUIHDtB8VGJKHhYQI0buaK6PZQw3eZSyYj6BqOVm1IxwJel+c2o 2NUb+wRpbVnHkvujwCtw6SNZUcz1LP6K3w8YHzCVsBd6CHPf76ch8DWVU4HzucxaMRcxQJ 4REXR1kGcSzZNYZmt3ScSsoR+UWz3L9lSO5SA5gr/ujUu/Vvy2kIm4oSJ2vZFeuOPObhTF TOQdlbu8dvsuHJOPKBdx56ArWA0H8dcfQxI+uPNReqXB3R93I/7EaylvoURBtQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1736481372; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=v5pktHVLP3+TTchPIRdKmSH46N+d7bDMVLBGmMFhqQo=; b=nsNXRQA+cYK7Rl9wQqZwYS4ckmE6VHX6i7ktSr0kADOUi9hr35ZCIIJ0qThm2QTaEn1+Eh a3RkIrX/uIsRBzM/iN/mzHtExig1f3NuXkJv4Bnp0tnixRYLs8dqrRlAJoFw51sqI2O0gL GUIhrMXOIaLI/U1ZlFlKW9TJF89WDRF5f6eSsxacVCYzjzpQubnMaZISLjJLhBvDVpZzg8 /p/RQhs8FH8qiIGdRwEHkKYnbz5L3dw7vwOd4e+efm5qdEV4BibCP1n8RxrSvfOnVr0Fcy ffWo1ggs9QmDbHC9lnxFym21My577Asqr/FH0TqJs6qBXOLLa/xebXrk7Dz56w== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1736481372; a=rsa-sha256; cv=none; b=kwPHIxD42IxW2L1aukLT/GYHN2Te4rRnGAiuQl4fkVrv6/nNnHxRJX3fLBQ01B9kjUT7lL NaazIkuX+I8io3N5mYPGSeW69fWTfOjgVffwbaQEoQJKwwmDa995hNG5PnTzVP1hYsrUs1 dlSWe6Y6mZGlMj45rShRQvgjRKIVl0KMYxQBrdXrXnIJ8FJ6PD1EVByKF+yPVZHmY7PBpO /6KuAkclgZkx0yYT9CYYYlx8xAc2QbUZO4qSp5P/izyLT3ECO6J7jE4VWczJAX0MbOZvKp DCDSS5dZQ8NlHMw/fxTK2hKgO/2UWbuZQrlkeQMZVg3jFm/UM0NPy9FGl/gSjA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4YTnrX1FHPzwGb; Fri, 10 Jan 2025 03:56:12 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 50A3uCWJ005303; Fri, 10 Jan 2025 03:56:12 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 50A3uC7w005300; Fri, 10 Jan 2025 03:56:12 GMT (envelope-from git) Date: Fri, 10 Jan 2025 03:56:12 GMT Message-Id: <202501100356.50A3uC7w005300@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Rick Macklem Subject: git: f9f0a1d61c7b - main - nfscl: Fix a crash when a readdir entry has nul in it List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: rmacklem X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: f9f0a1d61c7b97c705246c747baec385e0592966 Auto-Submitted: auto-generated The branch main has been updated by rmacklem: URL: https://cgit.FreeBSD.org/src/commit/?id=f9f0a1d61c7b97c705246c747baec385e0592966 commit f9f0a1d61c7b97c705246c747baec385e0592966 Author: Rick Macklem AuthorDate: 2025-01-10 03:54:41 +0000 Commit: Rick Macklem CommitDate: 2025-01-10 03:54:41 +0000 nfscl: Fix a crash when a readdir entry has nul in it Commit 026cdaa3b3a9 added a check for a nul or "/" in a file name in a readdir reply. Unfortunately, the minimal testing done on it did not detect a bug that can cause the client to crash. This patch fixes the code so that it does not crash. Note that a NFS server will not normally return a file name in a readdir reply that has a nul or "/" in it, so the crash is unlikely. PR: 283965 Reported by: asomers Tested by: asomers MFC after: 2 weeks --- sys/fs/nfsclient/nfs_clrpcops.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/sys/fs/nfsclient/nfs_clrpcops.c b/sys/fs/nfsclient/nfs_clrpcops.c index e1c02a71939b..c35d0c6295b9 100644 --- a/sys/fs/nfsclient/nfs_clrpcops.c +++ b/sys/fs/nfsclient/nfs_clrpcops.c @@ -3397,6 +3397,7 @@ nfsrpc_readdir(vnode_t vp, struct uio *uiop, nfsuint64 *cookiep, nfsattrbit_t attrbits, dattrbits; u_int32_t rderr, *tl2 = NULL; size_t tresid; + bool validentry; KASSERT(uiop->uio_iovcnt == 1 && (uiop->uio_resid & (DIRBLKSIZ - 1)) == 0, @@ -3622,6 +3623,7 @@ nfsrpc_readdir(vnode_t vp, struct uio *uiop, nfsuint64 *cookiep, /* loop through the dir entries, doctoring them to 4bsd form */ while (more_dirs && bigenough) { + validentry = true; if (nd->nd_flag & ND_NFSV4) { NFSM_DISSECT(tl, u_int32_t *, 3*NFSX_UNSIGNED); ncookie.lval[0] = *tl++; @@ -3701,6 +3703,7 @@ nfsrpc_readdir(vnode_t vp, struct uio *uiop, nfsuint64 *cookiep, uiop->uio_offset = savoff; uiop->uio_resid = savresid; blksiz = savblksiz; + validentry = false; } else { cp = uiop->uio_iov->iov_base; tlen -= len; @@ -3738,7 +3741,7 @@ nfsrpc_readdir(vnode_t vp, struct uio *uiop, nfsuint64 *cookiep, ncookie.lval[0] = 0; ncookie.lval[1] = *tl++; } - if (bigenough) { + if (bigenough && validentry) { if (nd->nd_flag & ND_NFSV4) { if (rderr) { dp->d_fileno = 0; @@ -3875,7 +3878,7 @@ nfsrpc_readdirplus(vnode_t vp, struct uio *uiop, nfsuint64 *cookiep, size_t tresid; u_int32_t *tl2 = NULL, rderr; struct timespec dctime, ts; - bool attr_ok; + bool attr_ok, validentry; KASSERT(uiop->uio_iovcnt == 1 && (uiop->uio_resid & (DIRBLKSIZ - 1)) == 0, @@ -4086,6 +4089,7 @@ nfsrpc_readdirplus(vnode_t vp, struct uio *uiop, nfsuint64 *cookiep, /* loop through the dir entries, doctoring them to 4bsd form */ while (more_dirs && bigenough) { + validentry = true; NFSM_DISSECT(tl, u_int32_t *, 3 * NFSX_UNSIGNED); if (nd->nd_flag & ND_NFSV4) { ncookie.lval[0] = *tl++; @@ -4161,6 +4165,7 @@ nfsrpc_readdirplus(vnode_t vp, struct uio *uiop, nfsuint64 *cookiep, uiop->uio_offset = savoff; uiop->uio_resid = savresid; blksiz = savblksiz; + validentry = false; } else { cp = uiop->uio_iov->iov_base; tlen -= len; @@ -4217,7 +4222,7 @@ nfsrpc_readdirplus(vnode_t vp, struct uio *uiop, nfsuint64 *cookiep, goto nfsmout; } - if (bigenough) { + if (bigenough && validentry) { if (nd->nd_flag & ND_NFSV4) { if (rderr) { dp->d_fileno = 0;