Re: [PATCH] nfsd: prevent NFSv4.1 SEQUENCE reply-cache overflow

[Mayank Jangid]

Hi Chuck,

Thanks for pointing me to Jérémy's series.

I tested the queued fix against our reproducer, and it resolves the issue. I can no longer reproduce the reply buffer overflow with the two patches applied.

Please feel free to add:
Tested-by: Mayank Jangid (OpenSec Intelligence) mayank.jangid.moon@xxxxxxxxx <mailto:mayank.jangid.moon@xxxxxxxxx>

Thanks,
Mayank Jangid
OpenSec Intelligence

> On 22 Sep 2026, at 7:36 PM, Chuck Lever <cel@xxxxxxxxxx> wrote:
> 
> On 9/22/26 7:26 AM, Mayank Jangid (OpenSec Intelligence) wrote:
>> nfsd4_sequence() narrows the reply buffer to the session cached-response
>> limit before accepting the slot sequence ID. A client can negotiate
>> ca_maxresponsesize_cached down to NFSD_MIN_HDR_SEQ_SZ, leaving no storage
>> in the slot trailing sl_data[] array.
> 
> Thanks for the report and the patch. Jérémy Jean reported the same
> issue in August, and a fix for it is already queued in the nfsd-testing
> branch:
> 
>  https://lore.kernel.org/linux-nfs/20260817-jean-v1-0-9e356596ab85@xxxxxxxxxx/
> 
> Patch 1/2 there adds the same pre-flight check of the SEQUENCE reply
> size before nfsd4_sequence() narrows the buffer and accepts the slot,
> and patch 2/2 sets op->status when an operation header cannot be
> encoded. Your patch does the same two things, so I won't apply it on
> top of that series.
> 
> If you can test the queued fix against your reproducer and confirm it
> addresses the overflow you found, a Tested-by: on that thread would be
> welcome.
> 
> -- 
> Chuck Lever (Come to NFS bake-a-thon! https://nfsv4bat.org)