From:   Chuck Lever III <chuck.lever@oracle.com>
To:     "rtm@csail.mit.edu" <rtm@csail.mit.edu>
CC:     Bruce Fields <bfields@fieldses.org>,
        Linux NFS Mailing List <linux-nfs@vger.kernel.org>
Subject: Re: NFS client can crash server due to overrun in
 nfsd4_decode_bitmap4()
Thread-Topic: NFS client can crash server due to overrun in
 nfsd4_decode_bitmap4()
Thread-Index: AQHX2NFEStLOh5EPHEGsmzKRU+63DKwB8uQA
Date:   Sat, 13 Nov 2021 21:06:03 +0000
Message-ID: <11B4530A-C0A0-4779-A9BA-F0E19B62C5A6@oracle.com>
References: <97860.1636837122@crash.local>
In-Reply-To: <97860.1636837122@crash.local>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?SD3hhIpKHMbmCEMIk5nvp5M68vFDvw1bRIGXWZzmBPWk8ZTj62KWa6qhOuXM?=
 =?us-ascii?Q?wowBjGKTv4pILutXCYQBQugO6BKa2sYyQs6UXmlhkahjIjYTzYpvI9BlW7mj?=
 =?us-ascii?Q?sadCygYNWbAu/PqwAG4yjithftzDL02uBkebK/Qpninlhhvj0a/FGAOH9eSC?=
 =?us-ascii?Q?WmpskKDk8YFKwPM5IGdzDp/XfeCeK0wfgvy4Z/2/vrFDfdTWVbuMYuh/8jSu?=
 =?us-ascii?Q?hihUosWl8s/RAsPQZLG7l/eE8+Pr/1VJ9E9oC/ba92msBaiebCBlCxX5GJp5?=
 =?us-ascii?Q?Sl2+e0sjb9x78burSKt0RxYIjciAVLji9npPjSC7hQRifXGn8RnsLPg0gUuo?=
 =?us-ascii?Q?ZGbu+sDVY/EKpPDj0Smefi13dykPQBulsbwdcT+vUF8vRVnwTsiqbDMZniS9?=
 =?us-ascii?Q?JOBJ646/f8M5G9/yC/JRb3pafVGWoXRNqvKX1wGSeXE5aCP9ykdu1M03EUbG?=
 =?us-ascii?Q?DxPPzuAUD7xB7iajx9wSjrK8fCdQeprOyW1X7oyGpK/e2m33F9lg0c5ujgpq?=
 =?us-ascii?Q?YlvHSfFECBeQBCw81Q4IMUigN0tVMV8Ttd16QWfBG3bPDDPAwiV5phcSuSJH?=
 =?us-ascii?Q?uqs1UCp90hwFI4y0UqRVL9adWLXYJa8WeEuMXc0p969P3Nk4F+iAcydBxIXm?=
 =?us-ascii?Q?0gL2i7DML/KM4Ovys0T0PT+/cRFQi7T+CuKyqpHYIedBnfE0aWdo28ue+pBp?=
 =?us-ascii?Q?r7egM1QENDb6Du61sdQUyfGN1MY7vv6dXIpj/bV1h3r5KUFY8PkO2+8EStuf?=
 =?us-ascii?Q?BQn7MnlgLFsrAMbdxdjmyPnde/croEMq0Cqs/lLYJ2+uGbktJt40zvJW7Q7T?=
 =?us-ascii?Q?6FUd66IjN+gyjDkAdtBR/j3QZQLsCJat/EO7we2046xIE1Lke8KctnJGY77v?=
 =?us-ascii?Q?0j8YPObGNR00178/Ttqpj8aDBu7ZF9K/BIcfmut6NnpA7nI0cU8SEuOzj3k2?=
 =?us-ascii?Q?Qccbk4ssN/6cO/Ux8Hz7+KibTyOvP0JfDJsBIN/SIoemd6seakZ99h8i/gZm?=
 =?us-ascii?Q?xa030aaze2lihdJNwNc+q7V4DWr6kVRFv5kezh4RshCTyp8GEWNbl5Dv9rhW?=
 =?us-ascii?Q?aRPyndH3rJ/5mWK1o7TxJfrJ77mSWkE/i1MfQJeEKKkh5CIFysonzZHetrmv?=
 =?us-ascii?Q?u1dHIY4rmFKwt89tLRJPDWDnuaDmNlQmDhsHwNlwo5BgEXWOZ0oa5eA6PVud?=
 =?us-ascii?Q?MU63kt/qXojD9yPO5jfIZ+Jd7yrPreMabkNhfAKCXjUE1oGDvb5qPm1s+v1c?=
 =?us-ascii?Q?DEfuX/J9xo3hqfChI+xR93zBp13lBoSbvMr/Pvx9MDTXtyOMwJ5XkYkkXYJB?=
 =?us-ascii?Q?WidFpVOazPPfObIShIoj/gYjowVHSzIe8E9RV29Al65qc7+V39R98LiHs3PN?=
 =?us-ascii?Q?86Qqbyoygw3McRRlKmGNmPp0pz7xSgQi7TBmGgbJpCgReKykfsR72sYRTlsi?=
 =?us-ascii?Q?BSBMo7+23TRHwXnSe8q62FP7w+7gIGbMNGWzIg8BEqbSUJpJnNEjlxD9fjfq?=
 =?us-ascii?Q?23VICqVHvsiTgMcwqEMagf1jMrxBoei1hBkVJa+2ZDi+EnJ3btndMU5YTy8A?=
 =?us-ascii?Q?CGoRZPLNsQxjmrPJ2XUL2oUqp3E3FB9UP7XrIArEKEuAMiY7QLAoum2Atk2z?=
 =?us-ascii?Q?ocHhD2LGZbL4gSdpjHYdJno=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-ID: <AB11231FA95A8446BA0069A8F7615E38@namprd10.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: SJ0PR10MB4688.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: a878512d-28fa-40fb-eed8-08d9a6e966d1
X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Nov 2021 21:06:03.0508
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: d3SFiQsL738AN6dKQPbOYg80X5FOsA4skBKtxNSyc5ho6JZFqSplQcze2hO7YRVVvWJk7agd2/8WJDnSjMpYRA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR10MB3221
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10167 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 phishscore=0 bulkscore=0
 adultscore=0 mlxlogscore=767 malwarescore=0 mlxscore=0 suspectscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000
 definitions=main-2111130128
X-Proofpoint-GUID: Pr6wRd0JOpjcD6R2b2N5SjqsQTXG6fYo
X-Proofpoint-ORIG-GUID: Pr6wRd0JOpjcD6R2b2N5SjqsQTXG6fYo
Precedence: bulk
List-ID: <linux-nfs.vger.kernel.org>
X-Mailing-List: linux-nfs@vger.kernel.org


> On Nov 13, 2021, at 3:58 PM, rtm@csail.mit.edu wrote:
>=20
> nfsd4_decode_bitmap4() will write beyond bmval[bmlen-1] if the RPC
> directs it to do so. This can cause nfsd4_decode_state_protect4_a() to
> write client-supplied data beyond the end of
> nfsd4_exchange_id.spo_must_allow[] when called by
> nfsd4_decode_exchange_id().

Thanks, I'll look into addressing this for v5.16-rc.

By the way, can you tell if this exposure was in the code
before 2548aa784d76 ("NFSD: Add a separate decoder to handle
state_protect_ops") ? (ie, do we need a separate fix for
this for pre-5.11 NFSD -- I'm guessing no).

Is the current implementation of nfsd4_decode_bitmap() a
problem for its other consumers?


> I've attached a demo in which the client's EXCHANGE_ID RPC supplies an
> address (0x400) that nfsd4_decode_bitmap4() writes into
> nii_domain.data due to overflowing bmval[]. The EXCHANGE_ID RPC also
> supplies a zero-length eia_client_impl_id<>. The result is that
> copy_impl_id() (called by nfsd4_exchange_id()) tries to read from
> address 0x400.
>=20
> # cc nfsd_1.c
> # uname -a
> Linux (none) 5.15.0-rc7-dirty #64 SMP Sat Nov 13 20:10:21 UTC 2021 riscv6=
4 riscv64 riscv64 GNU/Linux
> # ./nfsd_1
> ...
> [   16.600786] Unable to handle kernel NULL pointer dereference at virtua=
l address 0000000000000400
> [   16.643621] epc : __memcpy+0x3c/0xf8
> [   16.650154]  ra : kmemdup+0x2c/0x3c
> [   16.657733] epc : ffffffff803667bc ra : ffffffff800e80fe sp : ffffffd0=
00553c20
> [   16.777502] status: 0000000200000121 badaddr: 0000000000000400 cause: =
000000000000000d
> [   16.788193] [<ffffffff803667bc>] __memcpy+0x3c/0xf8
> [   16.796504] [<ffffffff8028cf0e>] nfsd4_exchange_id+0xe6/0x406
> [   16.806159] [<ffffffff8027c352>] nfsd4_proc_compound+0x2b4/0x4e8
> [   16.815721] [<ffffffff80266782>] nfsd_dispatch+0x118/0x172
> [   16.823405] [<ffffffff807633fa>] svc_process_common+0x2de/0x62c
> [   16.832935] [<ffffffff8076380c>] svc_process+0xc4/0x102
> [   16.840421] [<ffffffff802661de>] nfsd+0x102/0x16a
> [   16.848520] [<ffffffff80025b60>] kthread+0xfe/0x110
> [   16.856648] [<ffffffff80003054>] ret_from_exception+0x0/0xc
>=20
> <nfsd_1.c>

--
Chuck Lever