Re: [PATCH] NFS: blocklayout: reject oversized SCSI designators

[Jérémy Jean]

On 2026-08-26 10:07, Jérémy Jean wrote:
> A SCSI GETDEVICEINFO reply can encode designator_len as 0xffffffff.  
> The
> current signed field turns that into -1, so the size check is bypassed 
> and
> the value is converted to SIZE_MAX for xdr_inline_decode() and 
> memcpy().
>
> The attacker model considers a controlled NFSv4.1+ server and a client
> already mounted to that server. An OOB read can be triggered in the 
> client
> on a file read. KASAN reports:
>
>   BUG: KASAN: out-of-bounds in bl_alloc_deviceid_node+0x616/0x1110
>   Read of size 18446744073709551615
>   ...
>   __asan_memcpy+0x23/0x60
>   bl_alloc_deviceid_node+0x616/0x1110
>   nfs4_find_get_deviceid+0x565/0x810
>   bl_alloc_lseg+0x638/0x12d0
>   pnfs_layout_process+0x2b6/0xcf0
>   nfs4_proc_layoutget+0x4b3/0xd30
>
>
> The fix stores the length as u32 and reject oversized values before 
> decoding.
> The check is moved up before the call to xdr_inline_decode().
>
> [...]

Hello,

Did you have time to look into that?
The OOB read is currently still present.

Thanks,
Jérémy