svn commit: r360032 - head/sys/fs/nfsserver

[Rick Macklem]

Author: rmacklem
Date: Fri Apr 17 02:21:46 2020
New Revision: 360032
URL: https://svnweb.freebsd.org/changeset/base/360032

Log:
  Add a sanity check for nes_numsecflavor to the NFS server.
  
  Ryan Moeller reported crashes in the NFS server that appear to be
  caused by stack corruption in nfsrv_compound(). It appears that
  the stack got corrupted just after a NFSv4.1 Lookup that crosses
  a server mount point.
  Although it is just a "theory" at this point, the most obvious way
  the stack could get corrupted would be if nfsvno_checkexp() somehow
  acquires an export with a bogus nes_numsecflavor value. This would
  cause the copying of the secflavors to run off the end of the array,
  which is allocated on the stack below where the corruption occurs.
  
  This sanity check is simple to do and would stop the stack corruption
  if the theory is correct. Otherwise, doing the sanity check seems to
  be a reasonable safety belt to add to the code.
  
  Reported by:	freqlabs
  MFC after:	2 weeks

Modified:
  head/sys/fs/nfsserver/nfs_nfsdport.c

Modified: head/sys/fs/nfsserver/nfs_nfsdport.c
==============================================================================
--- head/sys/fs/nfsserver/nfs_nfsdport.c	Fri Apr 17 02:09:31 2020	(r360031)
+++ head/sys/fs/nfsserver/nfs_nfsdport.c	Fri Apr 17 02:21:46 2020	(r360032)
@@ -3066,6 +3066,11 @@ nfsvno_checkexp(struct mount *mp, struct sockaddr *nam
 			exp->nes_numsecflavor = 0;
 			error = 0;
 		}
+	} else if (exp->nes_numsecflavor < 1 || exp->nes_numsecflavor >
+	    MAXSECFLAVORS) {
+		printf("nfsvno_checkexp: numsecflavors out of range\n");
+		exp->nes_numsecflavor = 0;
+		error = EACCES;
 	} else {
 		/* Copy the security flavors. */
 		for (i = 0; i < exp->nes_numsecflavor; i++)
@@ -3102,6 +3107,12 @@ nfsvno_fhtovp(struct mount *mp, fhandle_t *fhp, struct
 			} else {
 				vput(*vpp);
 			}
+		} else if (exp->nes_numsecflavor < 1 || exp->nes_numsecflavor >
+		    MAXSECFLAVORS) {
+			printf("nfsvno_fhtovp: numsecflavors out of range\n");
+			exp->nes_numsecflavor = 0;
+			error = EACCES;
+			vput(*vpp);
 		} else {
 			/* Copy the security flavors. */
 			for (i = 0; i < exp->nes_numsecflavor; i++)