[nfsv4] Re: knfsd related bug reported to FreeBSD

[Pali Rohár <[e-mail]>]

Hello Rick,

Just a quick reply. I have not looked at the pcap yet but I know that
wireshark incorrectly decodes some of NFS4 packets with GETATTR opcode.
I have my own modification of wireshark to fix this problem.

So it could be possible that server is sending the correct reply and
just wireshark dissect it incorrect.

I'm not saying that it is this case, just to be aware of it.

Pali

On Friday 13 December 2024 16:47:45 Rick Macklem wrote:
> Hi,
> 
> The attached pcap file shows that the knfsd server generates
> bogus XDR for the reply to a GETATTR that follows a READDIR
> operation.
> 
> More specifically, if you look at the pcap file in wireshark
> and go to packet#22 and then click on the operations and
> then "Opcode: GETATTR (9)", the start of
> the XDR for the GETATTR will be highlighted in the hexadecimal
> window.
> Now, if you look at what follows (in the hexadeciaml window),
> you'll see that the GETATTR reply looks like:
> - GETATTR (9)
> - NFS4_OK (0)
> - Length of bitmap (0) <-- Not (2)
> - 2 words of attribute bitmap
> - 98 (length of attributes in hex)
> - attribute values
> 
> Everything looks ok, except the number of bitmap words is
> 0 and not 2.
> 
> Since the knfsd does not do this normally, I'd guess it is
> some sort of runaway pointer or use after free type bug that
> causes this, maybe?
> 
> Sofar, it only appears to happen when the GETATTR follows a
> READDIR operation.
> 
> This was reported to me for a FreeBSD client mounting the following:
> Debian 12 w/kernel:
> $ uname -r
> 6.1.0-25-amd64
> 
> > - what type of file system it exports
> 
> ZFS:
> 
> $ dpkg -l | fgrep libzfs4linux
> ii  libzfs4linux                    2.1.11-1
>                amd64
> I suspect that ZFS exports are not common for the Linux knfsd?
> 
> Anyhow, I am not sure if you have seen such a problem before,
> but I thought I would at least report it.
> (I have cc'd the reporter, in case you have questions for him.)
> 
> rick
> ps: If the pcap file does not make it through the mailing list, email and
>       I can send you a copy.