[nfsv4] Re: knfsd related bug reported to FreeBSD

[Pali Rohár <[e-mail]>]

On Friday 13 December 2024 17:02:17 Rick Macklem wrote:
> On Fri, Dec 13, 2024 at 4:59 PM Pali Rohár <[e-mail]> wrote:
> >
> > Hello Rick,
> >
> > Just a quick reply. I have not looked at the pcap yet but I know that
> > wireshark incorrectly decodes some of NFS4 packets with GETATTR opcode.
> > I have my own modification of wireshark to fix this problem.
> >
> > So it could be possible that server is sending the correct reply and
> > just wireshark dissect it incorrect.
> >
> > I'm not saying that it is this case, just to be aware of it.
> In this case, I am looking at the hexadecimal for the on-the-wire
> packet and it does not look correct.
> 
> Also, FreeBSD fails the reply as incorrect XDR.
> 
> rick

Now I have looked at your pcap and I'm confirming that the packet #22 is
really incorrect. It is not possible to decode XDR buffer, as you wrote.

> >
> > Pali
> >
> > On Friday 13 December 2024 16:47:45 Rick Macklem wrote:
> > > Hi,
> > >
> > > The attached pcap file shows that the knfsd server generates
> > > bogus XDR for the reply to a GETATTR that follows a READDIR
> > > operation.
> > >
> > > More specifically, if you look at the pcap file in wireshark
> > > and go to packet#22 and then click on the operations and
> > > then "Opcode: GETATTR (9)", the start of
> > > the XDR for the GETATTR will be highlighted in the hexadecimal
> > > window.
> > > Now, if you look at what follows (in the hexadeciaml window),
> > > you'll see that the GETATTR reply looks like:
> > > - GETATTR (9)
> > > - NFS4_OK (0)
> > > - Length of bitmap (0) <-- Not (2)
> > > - 2 words of attribute bitmap
> > > - 98 (length of attributes in hex)
> > > - attribute values
> > >
> > > Everything looks ok, except the number of bitmap words is
> > > 0 and not 2.
> > >
> > > Since the knfsd does not do this normally, I'd guess it is
> > > some sort of runaway pointer or use after free type bug that
> > > causes this, maybe?
> > >
> > > Sofar, it only appears to happen when the GETATTR follows a
> > > READDIR operation.
> > >
> > > This was reported to me for a FreeBSD client mounting the following:
> > > Debian 12 w/kernel:
> > > $ uname -r
> > > 6.1.0-25-amd64
> > >
> > > > - what type of file system it exports
> > >
> > > ZFS:
> > >
> > > $ dpkg -l | fgrep libzfs4linux
> > > ii  libzfs4linux                    2.1.11-1
> > >                amd64
> > > I suspect that ZFS exports are not common for the Linux knfsd?
> > >
> > > Anyhow, I am not sure if you have seen such a problem before,
> > > but I thought I would at least report it.
> > > (I have cc'd the reporter, in case you have questions for him.)
> > >
> > > rick
> > > ps: If the pcap file does not make it through the mailing list, email and
> > >       I can send you a copy.
> 
> _______________________________________________
> nfsv4 mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]