Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Jeff Layton <jlayton@kernel.org>
To:     chuck.lever@oracle.com
Cc:     linux-nfs@vger.kernel.org
Subject: [PATCH] nfsd: don't allow OPDESC to walk off the end of nfsd4_ops
Date:   Thu, 30 Mar 2023 14:57:29 -0400
Message-Id: <20230330185729.22895-1-jlayton@kernel.org>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

Ensure that OPDESC() doesn't return a pointer that doesn't lie within
the array. In particular, this is a problem when this funtion is passed
OP_ILLEGAL, but let's return NULL for any invalid value.

Signed-off-by: Jeff Layton <jlayton@kernel.org>
---
 fs/nfsd/nfs4proc.c | 2 ++
 1 file changed, 2 insertions(+)

This is the patch that I think we want ahead of this one:

    nfsd: call op_release, even when op_func returns an error

If you end up with OP_ILLEGAL, then op->opdesc ends up pointing
somewhere far, far away, and the new op_release changes can trip over
that.  We could add a Fixes tag for this, I suppose:

    22b03214962e nfsd4: introduce OPDESC helper

...but that commit is from 2011, so it's probably not worth it.

diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 5ae670807449..5e7b4ca7a266 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -2494,6 +2494,8 @@ static __be32 nfs41_check_op_ordering(struct nfsd4_compoundargs *args)
 
 const struct nfsd4_operation *OPDESC(struct nfsd4_op *op)
 {
+	if (op->opnum < FIRST_NFS4_OP || op->opnum > LAST_NFS42_OP)
+		return NULL;
 	return &nfsd4_ops[op->opnum];
 }
 
-- 
2.39.2