In decode_op_map() in fs/nfs/nfs4xdr.c:
uint32_t bitmap_words;
...;
bitmap_words = be32_to_cpup(p++);
if (bitmap_words > NFS4_OP_MAP_NUM_WORDS)
return -EIO;
...;
p = xdr_inline_decode(xdr, 4 * bitmap_words);
for (i = 0; i < bitmap_words; i++)
op_map->u.words[i] = be32_to_cpup(p++);
The return value from xdr_inline_decode() isn't checked, so there can be
a null-pointer dereference if there aren't enough bytes left in the RPC
message.
I've attached a program that produces the bug on my 5.15 machine:
# cc nfs_2.c
# ./a.out
mount:mount.nfs: timeout set for Thu Nov 4 21:10:28 2021
mount.nfs: trying text-based options 'vers=4.2,addr=127.0.0.1,clientaddr=127.0.0.1'
[ 29.133142] random: fast init done
accept returned 4
proc 0
proc 1
[ 19.298637] Unable to handle kernel access to user memory without uaccess routines at virtual address 0000000000000000
[ 19.316686] Oops [#1]
[ 19.322023] Modules linked in:
[ 19.329310] CPU: 0 PID: 61 Comm: mount.nfs Not tainted 5.15.0-rc7-dirty #15
[ 19.341196] Hardware name: ucbbar,riscvemu-bare (DT)
[ 19.350236] epc : decode_op_map+0x78/0xba
[ 19.357992] ra : decode_op_map+0x62/0xba
[ 19.365744] epc : ffffffff8022d93c ra : ffffffff8022d926 sp : ffffffd0005736e0
...
[ 19.504650] status: 0000000200000121 badaddr: 0000000000000000 cause: 000000000000000d
[ 19.518135] [<ffffffff8022d93c>] decode_op_map+0x78/0xba
[ 19.528276] [<ffffffff80239db4>] nfs4_xdr_dec_exchange_id+0x1a6/0x57e
[ 19.540304] [<ffffffff8071af74>] rpcauth_unwrap_resp_decode+0x12/0x1a
[ 19.552386] [<ffffffff8071bc30>] rpcauth_unwrap_resp+0x12/0x1a
[ 19.563960] [<ffffffff80711fcc>] call_decode+0x112/0x176
[ 19.574123] [<ffffffff8071a4b0>] __rpc_execute+0x76/0x216
[ 19.584286] [<ffffffff8071aace>] rpc_execute+0x58/0x7e
[ 19.594443] [<ffffffff80713358>] rpc_run_task+0x12c/0x16c
[ 19.604541] [<ffffffff80224eba>] nfs4_run_exchange_id+0x1d8/0x262
[ 19.616149] [<ffffffff80224f68>] _nfs4_proc_exchange_id+0x24/0x2ba
[ 19.627761] [<ffffffff8022cfc4>] nfs4_proc_exchange_id+0x30/0x50
[ 19.639397] [<ffffffff8023ea3e>] nfs41_discover_server_trunking+0x1c/0xa8
[ 19.651468] [<ffffffff80240d64>] nfs4_discover_server_trunking+0x7c/0x1e8
[ 19.663549] [<ffffffff80249114>] nfs4_init_client+0x92/0xf6
[ 19.673663] [<ffffffff80205412>] nfs_get_client+0x36a/0x394
[ 19.683817] [<ffffffff80248844>] nfs4_set_client+0xd6/0x13e
[ 19.693935] [<ffffffff80249830>] nfs4_create_server+0xb8/0x208
[ 19.705529] [<ffffffff8024161c>] nfs4_try_get_tree+0x16/0x4c
[ 19.717147] [<ffffffff80218bac>] nfs_get_tree+0x34a/0x3ac
[ 19.727243] [<ffffffff8012bce4>] vfs_get_tree+0x18/0x88
[ 19.737351] [<ffffffff8014a28e>] path_mount+0x4f4/0x77a
[ 19.747521] [<ffffffff8014a560>] do_mount+0x4c/0x7e
[ 19.757264] [<ffffffff8014a912>] sys_mount+0xca/0x14e
[ 19.767418] [<ffffffff80003046>] ret_from_syscall+0x0/0x2
Attachment:
nfs_2.c
Description: Binary data
