Re: [PATCH] nfsd: check get_user() return when reading princhashlen

[Jeff Layton]

On Thu, 2026-05-21 at 17:46 +0200, Dominik Woźniak wrote:
> In __cld_pipe_inprogress_downcall(), the get_user() that reads
> princhashlen from the userspace cld_msg_v2 buffer does not check its
> return value. A failing copy leaves princhashlen with uninitialised
> stack contents, which are then used to drive memdup_user() and stored
> as princhash.len on the resulting reclaim record. The other get_user()
> calls in this function all check the return; only this one is missed,
> which is most likely a copy-paste oversight from when v2 upcalls were
> introduced.
> 
> Mirror the existing pattern used a few lines above for namelen.
> namecopy is declared with __free(kfree) so the early return cleans up
> the already-allocated buffer automatically.
> 
> Fixes: 6ee95d1c8991 ("nfsd: add support for upcall version 2")
> Signed-off-by: Dominik Woźniak <stalion@xxxxxxxxx>
> ---
>  fs/nfsd/nfs4recover.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
> index b338473d6e52..6ea25a52d2f4 100644
> --- a/fs/nfsd/nfs4recover.c
> +++ b/fs/nfsd/nfs4recover.c
> @@ -718,7 +718,8 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg,
>  				return PTR_ERR(namecopy);
>  			name.data = namecopy;
>  			name.len = namelen;
> -			get_user(princhashlen, &ci->cc_princhash.cp_len);
> +			if (get_user(princhashlen, &ci->cc_princhash.cp_len))
> +				return -EFAULT;
>  			if (princhashlen > 0) {
>  				princhashcopy = memdup_user(
>  					&ci->cc_princhash.cp_data,

Nice catch.

Reviewed-by: Jeff Layton <jlayton@xxxxxxxxxx>