[nfsv4] Re: knfsd related bug reported to FreeBSD

[Rick Macklem <[e-mail]>]

On Fri, Dec 13, 2024 at 4:59 PM Pali Rohár <[e-mail]> wrote:
>
> Hello Rick,
>
> Just a quick reply. I have not looked at the pcap yet but I know that
> wireshark incorrectly decodes some of NFS4 packets with GETATTR opcode.
> I have my own modification of wireshark to fix this problem.
>
> So it could be possible that server is sending the correct reply and
> just wireshark dissect it incorrect.
>
> I'm not saying that it is this case, just to be aware of it.
In this case, I am looking at the hexadecimal for the on-the-wire
packet and it does not look correct.

Also, FreeBSD fails the reply as incorrect XDR.

rick

>
> Pali
>
> On Friday 13 December 2024 16:47:45 Rick Macklem wrote:
> > Hi,
> >
> > The attached pcap file shows that the knfsd server generates
> > bogus XDR for the reply to a GETATTR that follows a READDIR
> > operation.
> >
> > More specifically, if you look at the pcap file in wireshark
> > and go to packet#22 and then click on the operations and
> > then "Opcode: GETATTR (9)", the start of
> > the XDR for the GETATTR will be highlighted in the hexadecimal
> > window.
> > Now, if you look at what follows (in the hexadeciaml window),
> > you'll see that the GETATTR reply looks like:
> > - GETATTR (9)
> > - NFS4_OK (0)
> > - Length of bitmap (0) <-- Not (2)
> > - 2 words of attribute bitmap
> > - 98 (length of attributes in hex)
> > - attribute values
> >
> > Everything looks ok, except the number of bitmap words is
> > 0 and not 2.
> >
> > Since the knfsd does not do this normally, I'd guess it is
> > some sort of runaway pointer or use after free type bug that
> > causes this, maybe?
> >
> > Sofar, it only appears to happen when the GETATTR follows a
> > READDIR operation.
> >
> > This was reported to me for a FreeBSD client mounting the following:
> > Debian 12 w/kernel:
> > $ uname -r
> > 6.1.0-25-amd64
> >
> > > - what type of file system it exports
> >
> > ZFS:
> >
> > $ dpkg -l | fgrep libzfs4linux
> > ii  libzfs4linux                    2.1.11-1
> >                amd64
> > I suspect that ZFS exports are not common for the Linux knfsd?
> >
> > Anyhow, I am not sure if you have seen such a problem before,
> > but I thought I would at least report it.
> > (I have cc'd the reporter, in case you have questions for him.)
> >
> > rick
> > ps: If the pcap file does not make it through the mailing list, email and
> >       I can send you a copy.