From: Jenny Guanni Qu Date: Fri, 13 Mar 2026 22:42:07 +0000 (+0000) Subject: pnfs/flexfiles: validate ds_versions_cnt is non-zero X-Git-Tag: v7.1-rc1~12^2~8 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=94545ffc0ae8ae6ab6590e9d7fed4da8123060cb;p=thirdparty%2Fkernel%2Flinux.git pnfs/flexfiles: validate ds_versions_cnt is non-zero nfs4_ff_alloc_deviceid_node() reads version_count from XDR without checking it is non-zero. When a malicious NFS server sends a pNFS LAYOUTGET response with version_count=0, kcalloc(0, ...) returns ZERO_SIZE_PTR (0x10). The subsequent ds_versions[0] access in nfs4_ff_layout_ds_version() and other callers dereferences this invalid pointer, causing an out-of-bounds read. Add a check for version_count == 0 after parsing it from XDR, before the allocation. The OOB read was confirmed with KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] from accessing ZERO_SIZE_PTR. Fixes: d67ae825a59d ("pnfs/flexfiles: Add the FlexFile Layout Driver") Reported-by: Klaudia Kloc Reported-by: Dawid Moczadło Tested-by: Jenny Guanni Qu Signed-off-by: Jenny Guanni Qu Signed-off-by: Trond Myklebust --- diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c index c40395ae0814..1109462a9699 100644 --- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c +++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c @@ -97,6 +97,11 @@ nfs4_ff_alloc_deviceid_node(struct nfs_server *server, struct pnfs_device *pdev, if (unlikely(!p)) goto out_err_drain_dsaddrs; version_count = be32_to_cpup(p); + + if (version_count == 0) { + ret = -EINVAL; + goto out_err_drain_dsaddrs; + } dprintk("%s: version count %d\n", __func__, version_count); ds_versions = kzalloc_objs(struct nfs4_ff_ds_version, version_count,