[PATCH] nfsd: truncate LISTXATTRS replies on error

[PATCH] nfsd: truncate LISTXATTRS replies on error

[Hyunsol Mun]

nfsd4_encode_listxattrs() reserves 12 bytes for the reply cookie and
array count before it starts encoding attribute names. If the first user
attribute name does not fit in the client's maxcount, the encoder returns
NFS4ERR_TOOSMALL without initializing the reservation.

The generic COMPOUND encoder does not truncate replies for this error, so
the reserved bytes are transmitted after the operation status and can
disclose stale reply-buffer contents.

Save the XDR length on entry and restore it whenever the LISTXATTRS
encoder returns an error. This also discards partial output from other
errors after encoding has started.

Validation used nfsd-testing b4e06bef3884. On the unpatched x86_64
kernel, all 1,000 NFS4ERR_TOOSMALL replies contained the extra 12-byte
body. The leaked windows reconstructed another client's exact session ID
and enabled cached OPEN replay, stateid use, creation of a new session
for the victim client, and callback-state modification.

With this patch, two runs totaling 2,000 NFS4ERR_TOOSMALL replies
contained no extra body or leak window, so session reconstruction
failed. The victim's cached OPEN completed normally in both runs.

A patched-kernel smoke run also completed a successful LISTXATTRS
through an NFSv4.2 mount. NFSv4.2 and NFSv3 read/write/unmount tests
passed. All test kernels built with GCC 13.3 and CONFIG_WERROR, and no
kernel warning, Oops, or panic occurred. The reproducer and complete
logs are available privately on request.

The vulnerability research and validation were conducted by members of
the Tobabz team as part of the Best of the Best 15th program.

Fixes: 23e50fe3a5e6 ("nfsd: implement the xattr functions and en/decode logic")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Hyunsol Mun <muumthf@gmail.com>
---
 fs/nfsd/nfs4xdr.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index c4fd840da4d9..c7c2be555b59 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -6438,6 +6438,7 @@ nfsd4_encode_listxattrs(struct nfsd4_compoundres *resp, __be32 nfserr,
 {
 	struct nfsd4_listxattrs *listxattrs = &u->listxattrs;
 	struct xdr_stream *xdr = resp->xdr;
+	unsigned int starting_len = xdr->buf->len;
 	u32 cookie_offset, count_offset, eof;
 	u32 left, xdrleft, slen, count;
 	u32 xdrlen, offset;
@@ -6545,6 +6546,8 @@ nfsd4_encode_listxattrs(struct nfsd4_compoundres *resp, __be32 nfserr,
 out:
 	if (listxattrs->lsxa_len)
 		kvfree(listxattrs->lsxa_buf);
+	if (status)
+		xdr_truncate_encode(xdr, starting_len);
 	return status;
 }
 

base-commit: b4e06bef38843c8b909d0b4317dfaaf87dba6d72
-- 
2.50.1 (Apple Git-155)

Re: [PATCH] nfsd: truncate LISTXATTRS replies on error

[Chuck Lever]

On Wed, 21 Oct 2026 11:37:15 +0900, Hyunsol Mun wrote:
> nfsd4_encode_listxattrs() reserves 12 bytes for the reply cookie and
> array count before it starts encoding attribute names. If the first user
> attribute name does not fit in the client's maxcount, the encoder returns
> NFS4ERR_TOOSMALL without initializing the reservation.
> 
> The generic COMPOUND encoder does not truncate replies for this error, so
> the reserved bytes are transmitted after the operation status and can
> disclose stale reply-buffer contents.
> 
> [...]

Applied to nfsd-testing, thanks!

[1/1] nfsd: truncate LISTXATTRS replies on error
      commit: cab30e6ab042c665e54bc9408e9c7b7550417845

--
Chuck Lever

Re: [PATCH] nfsd: truncate LISTXATTRS replies on error

[Jeff Layton]

On Wed, 2026-10-21 at 11:37 +0900, Hyunsol Mun wrote:
> nfsd4_encode_listxattrs() reserves 12 bytes for the reply cookie and
> array count before it starts encoding attribute names. If the first user
> attribute name does not fit in the client's maxcount, the encoder returns
> NFS4ERR_TOOSMALL without initializing the reservation.
> 
> The generic COMPOUND encoder does not truncate replies for this error, so
> the reserved bytes are transmitted after the operation status and can
> disclose stale reply-buffer contents.
> 
> Save the XDR length on entry and restore it whenever the LISTXATTRS
> encoder returns an error. This also discards partial output from other
> errors after encoding has started.
> 
> Validation used nfsd-testing b4e06bef3884. On the unpatched x86_64
> kernel, all 1,000 NFS4ERR_TOOSMALL replies contained the extra 12-byte
> body. The leaked windows reconstructed another client's exact session ID
> and enabled cached OPEN replay, stateid use, creation of a new session
> for the victim client, and callback-state modification.
> 
> With this patch, two runs totaling 2,000 NFS4ERR_TOOSMALL replies
> contained no extra body or leak window, so session reconstruction
> failed. The victim's cached OPEN completed normally in both runs.
> 
> A patched-kernel smoke run also completed a successful LISTXATTRS
> through an NFSv4.2 mount. NFSv4.2 and NFSv3 read/write/unmount tests
> passed. All test kernels built with GCC 13.3 and CONFIG_WERROR, and no
> kernel warning, Oops, or panic occurred. The reproducer and complete
> logs are available privately on request.
> 
> The vulnerability research and validation were conducted by members of
> the Tobabz team as part of the Best of the Best 15th program.
> 
> Fixes: 23e50fe3a5e6 ("nfsd: implement the xattr functions and en/decode logic")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Hyunsol Mun <muumthf@gmail.com>
> ---
>  fs/nfsd/nfs4xdr.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
> index c4fd840da4d9..c7c2be555b59 100644
> --- a/fs/nfsd/nfs4xdr.c
> +++ b/fs/nfsd/nfs4xdr.c
> @@ -6438,6 +6438,7 @@ nfsd4_encode_listxattrs(struct nfsd4_compoundres *resp, __be32 nfserr,
>  {
>  	struct nfsd4_listxattrs *listxattrs = &u->listxattrs;
>  	struct xdr_stream *xdr = resp->xdr;
> +	unsigned int starting_len = xdr->buf->len;
>  	u32 cookie_offset, count_offset, eof;
>  	u32 left, xdrleft, slen, count;
>  	u32 xdrlen, offset;
> @@ -6545,6 +6546,8 @@ nfsd4_encode_listxattrs(struct nfsd4_compoundres *resp, __be32 nfserr,
>  out:
>  	if (listxattrs->lsxa_len)
>  		kvfree(listxattrs->lsxa_buf);
> +	if (status)
> +		xdr_truncate_encode(xdr, starting_len);
>  	return status;
>  }
>  
> 
> base-commit: b4e06bef38843c8b909d0b4317dfaaf87dba6d72

Reviewed-by: Jeff Layton <jlayton@kernel.org>