git: 47d75c29f551 - main - nfsd: Add a sanity check to SecinfoNoname for file type

[Rick Macklem]

The branch main has been updated by rmacklem:

URL: 
https://cgit.FreeBSD.org/src/commit/?id=47d75c29f5510ad844f0bc7fbc07d481ebb7fd9e

commit 47d75c29f5510ad844f0bc7fbc07d481ebb7fd9e
Author:     Rick Macklem <rmack...@freebsd.org>
AuthorDate: 2022-05-01 20:41:31 +0000
Commit:     Rick Macklem <rmack...@freebsd.org>
CommitDate: 2022-05-01 20:41:31 +0000

    nfsd: Add a sanity check to SecinfoNoname for file type
    
    Robert Morris reported that, for the case of SecinfoNoname
    with the Parent option, providing a non-directory could
    cause a crash.
    
    This patch adds a sanity check for v_type == VDIR for
    this case, to avoid the crash.
    
    Reported by:    r...@lcs.mit.edu
    PR:     260300
    MFC after:      2 weeks
---
 sys/fs/nfsserver/nfs_nfsdserv.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/sys/fs/nfsserver/nfs_nfsdserv.c b/sys/fs/nfsserver/nfs_nfsdserv.c
index 21d8fe05c0ad..3f896effd8ce 100644
--- a/sys/fs/nfsserver/nfs_nfsdserv.c
+++ b/sys/fs/nfsserver/nfs_nfsdserv.c
@@ -3822,6 +3822,11 @@ nfsrvd_secinfononame(struct nfsrv_descript *nd, int 
isdgram,
        fhstyle = fxdr_unsigned(int, *tl);
        switch (fhstyle) {
        case NFSSECINFONONAME_PARENT:
+               if (dp->v_type != VDIR) {
+                       vput(dp);
+                       nd->nd_repstat = NFSERR_NOTDIR;
+                       goto nfsmout;
+               }
                NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, LOOKUP,
                    LOCKLEAF | SAVESTART);
                nfsvno_setpathbuf(&named, &bufp, &hashp);