[PATCH 0/2] NFSv4.1/pnfs: bound GETDEVICEINFO notification bitmap length

[Michael Bommarito <michael.bommarito@gmail.com>]

decode_getdeviceinfo() scales a server-supplied notification bitmap
length by four for xdr_inline_decode(). The 32-bit multiply wraps to 0
for len >= 0x40000000, so the bounds check passes on an empty request
and the verify loop reads up to ~2^30 words past the inline XDR buffer.
A malicious or compromised pNFS server, or a man in the middle on an
unprotected mount, can drive this out-of-bounds read while the client
decodes a GETDEVICEINFO reply. It is a read, not a leak: the loop only
checks each word for nonzero and returns -EIO on the first, so over-read
contents are never returned.

A conformant reply uses a single notification word. Patch 1 bounds the
length before the scale so it cannot wrap. Patch 2 adds KUnit coverage
and is offered separately so it can be taken or dropped on its own.

Tested on QEMU x86_64 with KASAN: a Level-2 KUnit case drives the real
decode_getdeviceinfo() and reports a slab-out-of-bounds read on stock,
returning -EIO after patch 1; two benign controls drive the same decoder
in bounds and pass on both stock and fixed trees.

Michael Bommarito (2):
  NFSv4.1/pnfs: bound notification bitmap length in decode_getdeviceinfo
  NFSv4.1/pnfs: add KUnit coverage for GETDEVICEINFO notification decode

 fs/nfs/Kconfig                      |  14 ++++
 fs/nfs/getdeviceinfo_notify_kunit.c | 110 ++++++++++++++++++++++++++++
 fs/nfs/nfs4xdr.c                    |  10 ++-
 include/linux/nfs4.h                |   3 +
 4 files changed, 136 insertions(+), 1 deletion(-)
 create mode 100644 fs/nfs/getdeviceinfo_notify_kunit.c


base-commit: 5200f5f493f79f14bbdc349e402a40dfb32f23c8
-- 
2.53.0