nfsd: zero NFSv4 COMPOUND tag padding

[PATCH] nfsd: zero NFSv4 COMPOUND tag padding

Posted by Aldo Ariel Panzardo 1 week, 2 days ago

nfs4svc_encode_compoundres() copies the tag bytes into reserved XDR space
and skips directly to the aligned end of the field. xdr_reserve_space()
rounds the reservation up but does not initialize the padding bytes.

A remote client can choose a tag length that is not a multiple of four,
causing one to three stale bytes from the response page to be returned in
the COMPOUND reply.

Use xdr_encode_opaque_fixed() to copy the tag and clear its XDR padding.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
---
 fs/nfsd/nfs4xdr.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index e17488a911..9377f42dfd 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -6480,8 +6480,7 @@ nfs4svc_encode_compoundres(struct svc_rqst *rqstp, struct xdr_stream *xdr)
 
 	*p++ = resp->cstate.status;
 	*p++ = htonl(resp->taglen);
-	memcpy(p, resp->tag, resp->taglen);
-	p += XDR_QUADLEN(resp->taglen);
+	p = xdr_encode_opaque_fixed(p, resp->tag, resp->taglen);
 	*p++ = htonl(resp->opcnt);
 
 	nfsd4_sequence_done(resp);
-- 
2.43.0

Re: [PATCH] nfsd: zero NFSv4 COMPOUND tag padding

Posted by Chuck Lever 1 week, 2 days ago

On Tue, 15 Sep 2026 13:00:49 -0300, Aldo Ariel Panzardo wrote:
> nfs4svc_encode_compoundres() copies the tag bytes into reserved XDR space
> and skips directly to the aligned end of the field. xdr_reserve_space()
> rounds the reservation up but does not initialize the padding bytes.
> 
> A remote client can choose a tag length that is not a multiple of four,
> causing one to three stale bytes from the response page to be returned in
> the COMPOUND reply.
> 
> [...]

Applied to nfsd-testing, thanks!

[1/1] nfsd: zero NFSv4 COMPOUND tag padding
      commit: 28c0a5693a60625fb794943f2755c4bc5643f7c4

--
Chuck Lever

Re: [PATCH] nfsd: zero NFSv4 COMPOUND tag padding

Posted by Jeff Layton 1 week, 2 days ago

On Tue, 2026-09-15 at 13:00 -0300, Aldo Ariel Panzardo wrote:
> nfs4svc_encode_compoundres() copies the tag bytes into reserved XDR space
> and skips directly to the aligned end of the field. xdr_reserve_space()
> rounds the reservation up but does not initialize the padding bytes.
> 
> A remote client can choose a tag length that is not a multiple of four,
> causing one to three stale bytes from the response page to be returned in
> the COMPOUND reply.
> 
> Use xdr_encode_opaque_fixed() to copy the tag and clear its XDR padding.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
> ---
>  fs/nfsd/nfs4xdr.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
> index e17488a911..9377f42dfd 100644
> --- a/fs/nfsd/nfs4xdr.c
> +++ b/fs/nfsd/nfs4xdr.c
> @@ -6480,8 +6480,7 @@ nfs4svc_encode_compoundres(struct svc_rqst *rqstp, struct xdr_stream *xdr)
>  
>  	*p++ = resp->cstate.status;
>  	*p++ = htonl(resp->taglen);
> -	memcpy(p, resp->tag, resp->taglen);
> -	p += XDR_QUADLEN(resp->taglen);
> +	p = xdr_encode_opaque_fixed(p, resp->tag, resp->taglen);
>  	*p++ = htonl(resp->opcnt);
>  
>  	nfsd4_sequence_done(resp);

Reviewed-by: Jeff Layton <jlayton@kernel.org>