diff options
| author | Rick Macklem <rmacklem@FreeBSD.org> | 2026-05-25 19:22:32 +0000 |
|---|---|---|
| committer | Rick Macklem <rmacklem@FreeBSD.org> | 2026-05-25 19:22:32 +0000 |
| commit | 4d80d4913e79c8b5918b1f04c1c7b38e6c76b9b4 (patch) | |
| tree | 7658293270657d1816bbc41486e3e190df97bba7 | |
| parent | be9f35396449129ebe952fdd1c080f7856dee030 (diff) | |
nfs: Fix argument typo to avoid a crash
A typo resulted in the wrong argument for a bytewise
comparison that could result in a crash if
the incorrect argument was not a valid pointer.
This patch fixes the argument.
While investigating this, I noticed that the
correct argument was not being filled in as
required, so this patch fixes that, as well.
Somehow, recovery from a NFSv4.1/4.2 server
crash worked during testing, so this was not
detected. The bug/patch only affects NFS
client mounts using NFSv4.1/4.2.
PR: 294925
Reported by: Jov <amutu@amutu.com>
MFC after: 3 days
| -rw-r--r-- | sys/fs/nfs/nfs_commonkrpc.c | 5 | ||||
| -rw-r--r-- | sys/fs/nfs/nfs_commonsubs.c | 3 |
2 files changed, 6 insertions, 2 deletions
diff --git a/sys/fs/nfs/nfs_commonkrpc.c b/sys/fs/nfs/nfs_commonkrpc.c index 9ea4e5f4c9df..2d4c41994c0e 100644 --- a/sys/fs/nfs/nfs_commonkrpc.c +++ b/sys/fs/nfs/nfs_commonkrpc.c @@ -1265,8 +1265,9 @@ tryagain: goto out; } sep = NFSMNT_MDSSESSION(nmp); - if (bcmp(sep->nfsess_sessionid, nd->nd_sequence, - NFSX_V4SESSIONID) == 0) { + if (bcmp(sep->nfsess_sessionid, + nd->nd_sessionid, NFSX_V4SESSIONID) == 0 && + sep->nfsess_defunct == 0) { printf("Initiate recovery. If server " "has not rebooted, " "check NFS clients for unique " diff --git a/sys/fs/nfs/nfs_commonsubs.c b/sys/fs/nfs/nfs_commonsubs.c index b5f83a98b307..a11b55b11c43 100644 --- a/sys/fs/nfs/nfs_commonsubs.c +++ b/sys/fs/nfs/nfs_commonsubs.c @@ -368,6 +368,7 @@ nfscl_reqstart(struct nfsrv_descript *nd, int procnum, struct nfsmount *nmp, * First, fill in some of the fields of nd. */ nd->nd_slotseq = NULL; + NFSBZERO(nd->nd_sessionid, NFSX_V4SESSIONID); if (vers == NFS_VER4) { nd->nd_flag = ND_NFSV4 | ND_NFSCL; if (minorvers == NFSV41_MINORVERSION) @@ -5348,6 +5349,7 @@ nfsv4_setsequence(struct nfsmount *nmp, struct nfsrv_descript *nd, NFSM_BUILD(tl, uint32_t *, NFSX_V4SESSIONID + 4 * NFSX_UNSIGNED); nd->nd_sequence = tl; bcopy(sessionid, tl, NFSX_V4SESSIONID); + bcopy(sessionid, nd->nd_sessionid, NFSX_V4SESSIONID); tl += NFSX_V4SESSIONID / NFSX_UNSIGNED; nd->nd_slotseq = tl; if (error == 0) { @@ -5593,6 +5595,7 @@ nfsrpc_destroysession(struct nfsmount *nmp, struct nfsclsession *tsep, 0, NULL); NFSM_BUILD(tl, uint32_t *, NFSX_V4SESSIONID); bcopy(tsep->nfsess_sessionid, tl, NFSX_V4SESSIONID); + bcopy(tsep->nfsess_sessionid, nd->nd_sessionid, NFSX_V4SESSIONID); nd->nd_flag |= ND_USEGSSNAME; error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred, NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL); |