Re: [PATCH] nfsd: prevent NFSv4.1 SEQUENCE reply-cache overflow

[Chuck Lever]

On 9/22/26 7:26 AM, Mayank Jangid (OpenSec Intelligence) wrote:
> nfsd4_sequence() narrows the reply buffer to the session cached-response
> limit before accepting the slot sequence ID. A client can negotiate
> ca_maxresponsesize_cached down to NFSD_MIN_HDR_SEQ_SZ, leaving no storage
> in the slot trailing sl_data[] array.

Thanks for the report and the patch. Jérémy Jean reported the same
issue in August, and a fix for it is already queued in the nfsd-testing
branch:

  https://lore.kernel.org/linux-nfs/20260817-jean-v1-0-9e356596ab85@xxxxxxxxxx/

Patch 1/2 there adds the same pre-flight check of the SEQUENCE reply
size before nfsd4_sequence() narrows the buffer and accepts the slot,
and patch 2/2 sets op->status when an operation header cannot be
encoded. Your patch does the same two things, so I won't apply it on
top of that series.

If you can test the queued fix against your reproducer and confirm it
addresses the overflow you found, a Tested-by: on that thread would be
welcome.

-- 
Chuck Lever (Come to NFS bake-a-thon! https://nfsv4bat.org)