From: NeilBrown <neilb@ownmail.net>
To: "Chuck Lever" <cel@kernel.org>
Cc: "Jeff Layton" <jlayton@kernel.org>,
"Olga Kornievskaia" <okorniev@redhat.com>,
"Dai Ngo" <dai.ngo@oracle.com>, "Tom Talpey" <tom@talpey.com>,
linux-nfs@vger.kernel.org, "Chuck Lever" <chuck.lever@oracle.com>,
syzbot+60cfa08822470bbebe44@syzkaller.appspotmail.com
Subject: Re: [PATCH] sunrpc: prevent out-of-bounds read in __cache_seq_start()
Date: Wed, 22 Apr 2026 12:46:36 +1000 [thread overview]
Message-ID: <177682599675.1474915.15004300765582458400@noble.neil.brown.name> (raw)
In-Reply-To: <20260421161126.129533-1-cel@kernel.org>
On Wed, 22 Apr 2026, Chuck Lever wrote:
> From: Chuck Lever <chuck.lever@oracle.com>
>
> Commit 7b546bd89975 ("sunrpc/cache: improve RCU safety in
> cache_list walking.") changed the tail of __cache_seq_start()
> to unconditionally store
>
> *pos = ((long long)hash << 32) + 1
>
> before returning, dropping a prior "hash >= cd->hash_size"
> guard. When the while loop exits because every remaining
> bucket was empty, hash equals cd->hash_size, so the stored
> *pos is one position past the table's last valid bucket.
> seq_read_iter() caches that index in m->index. A subsequent
> pread(2) at the same file offset skips traverse() and hands
> the stored index back to __cache_seq_start(), which decodes
> hash = cd->hash_size and dereferences
> cd->hash_table[cd->hash_size] -- one hlist_head past the end
> of the kzalloc'd table.
>
> KASAN reports an eight-byte slab-out-of-bounds read at the
> tail of the 2048-byte hash_table allocation for the NFSD
> export cache (EXPORT_HASHMAX * sizeof(struct hlist_head) ==
> 256 * 8).
>
> Reject an input hash that is out of range before touching the
> hash table. cache_seq_next() already bounds-checks its own
> loop; the start routine needs to be symmetric.
>
> Reported-by: syzbot+60cfa08822470bbebe44@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=60cfa08822470bbebe44
> Fixes: 7b546bd89975 ("sunrpc/cache: improve RCU safety in cache_list walking.")
> Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Reviewed-by: NeilBrown <neil@brown.name>
Thanks for finding and fixing this.
We could of course avoid ever storing a too-large pos but adding
back a test for hash at the end of __cache_seq_start() but I prefer
the approach you took as it is more robust.
Thanks,
NeilBrown
> ---
> net/sunrpc/cache.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
> index 305c6e67f052..391037f15292 100644
> --- a/net/sunrpc/cache.c
> +++ b/net/sunrpc/cache.c
> @@ -1352,6 +1352,9 @@ static void *__cache_seq_start(struct seq_file *m, loff_t *pos)
> hash = n >> 32;
> entry = n & ((1LL<<32) - 1);
>
> + if (hash >= cd->hash_size)
> + return NULL;
> +
> hlist_for_each_entry_rcu(ch, &cd->hash_table[hash], cache_list)
> if (!entry--)
> return ch;
> --
> 2.53.0
>
>
next prev parent reply other threads:[~2026-04-22 2:46 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-21 16:11 [PATCH] sunrpc: prevent out-of-bounds read in __cache_seq_start() Chuck Lever
2026-04-21 20:33 ` Benjamin Coddington
2026-04-22 2:46 ` NeilBrown [this message]
2026-05-26 21:43 ` Calum Mackay
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=177682599675.1474915.15004300765582458400@noble.neil.brown.name \
--to=neilb@ownmail.net \
--cc=cel@kernel.org \
--cc=chuck.lever@oracle.com \
--cc=dai.ngo@oracle.com \
--cc=jlayton@kernel.org \
--cc=linux-nfs@vger.kernel.org \
--cc=neil@brown.name \
--cc=okorniev@redhat.com \
--cc=syzbot+60cfa08822470bbebe44@syzkaller.appspotmail.com \
--cc=tom@talpey.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).