NetBSD Problem Report #60554

From www@netbsd.org  Fri Aug  7 22:19:07 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.netbsd.org", Issuer "YR2" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 9BA611A9239
	for <gnats-bugs@gnats.NetBSD.org>; Fri,  7 Aug 2026 22:19:07 +0000 (UTC)
Message-Id: <20260807221906.274531A923B@mollari.NetBSD.org>
Date: Fri,  7 Aug 2026 22:19:06 +0000 (UTC)
From: campbell+netbsd@mumble.net
Reply-To: campbell+netbsd@mumble.net
To: gnats-bugs@NetBSD.org
Subject: nfs: integer shift UB in pathconf(_PC_FILESIZEBITS)
X-Send-Pr-Version: www-1.0
X-From4GNATS: "campbell+netbsd@mumble.net via gnats" <gnats-admin@NetBSD.org>

>Number:         60554
>Category:       kern
>Synopsis:       nfs: integer shift UB in pathconf(_PC_FILESIZEBITS)
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          pending-pullups
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Aug 07 22:20:00 +0000 2026
>Closed-Date:    
>Last-Modified:  Sun Oct 25 10:45:02 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10, 9, ...
>Organization:
The NfsBSD Infinite Loop, Inc.
>Environment:
>Description:

	When nmp->nm_maxfilesize is 64 bits long, this logic to compute
	ilog2(nmp->nm_maxfilesize) overflows the shift into undefined
	behaviour:

   3226 			for (l = 0, maxsize = nmp->nm_maxfilesize;
   3227 			    (maxsize >> l) > 0; l++)
   3228 				;

https://nxr.netbsd.org/xref/src/sys/nfs/nfs_vnops.c?r=1.327#3218

	This can be provoked by an nfs server that returns a large
	maxfilesize in the FSINFO request.

>How-To-Repeat:

	1. Set up an NFS server with maxfilesize = 2^64 - 1 (e.g.,
	   FreeBSD serving from ZFS).

	2. Mount it on NetBSD.

	3. Run `getconf GETFILESIZEBITS /mnt'.

>Fix:

	Use ilog2(maxsize) instead of the bespoke loop, taking care to
	handle the fencepost error required by definition of
	_PC_FILESIZEBITS:

     _PC_FILESIZEBITS
             If the maximum size file that could ever exist on the mounted
             file system is maxsize, then the returned value is 2 plus the
             floor of the base 2 logarithm of maxsize.

>Release-Note:

>Audit-Trail:
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60554 CVS commit: src/sys/nfs
Date: Sat, 8 Aug 2026 00:08:45 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Sat Aug  8 00:08:45 UTC 2026

 Modified Files:
 	src/sys/nfs: nfs_vnops.c

 Log Message:
 nfs_vnops.c: Sort includes.

 No functional change intended.  Preparation for:

 PR kern/60554: nfs: integer shift UB in pathconf(_PC_FILESIZEBITS)


 To generate a diff of this commit:
 cvs rdiff -u -r1.327 -r1.328 src/sys/nfs/nfs_vnops.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60554 CVS commit: src/sys/nfs
Date: Sat, 8 Aug 2026 00:09:25 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Sat Aug  8 00:09:25 UTC 2026

 Modified Files:
 	src/sys/nfs: nfs_vnops.c

 Log Message:
 nfs: Avoid UB in integer shift amounts.

 Just use ilog2 explicitly here, instead of writing out a loop with
 shifts and increments to compute it more slowly and buggily.  Note
 the confusing fencepost adjustment.  Clamp _PC_FILESIZEBITS at the
 actual size of off_t since we can't go beyond that.

 PR kern/60554: nfs: integer shift UB in pathconf(_PC_FILESIZEBITS)


 To generate a diff of this commit:
 cvs rdiff -u -r1.328 -r1.329 src/sys/nfs/nfs_vnops.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->needs-pullups
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Sat, 08 Aug 2026 00:20:49 +0000
State-Changed-Why:
fixed in HEAD, needs pullup-11, pullup-10, pullup-9


State-Changed-From-To: needs-pullups->pending-pullups
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Wed, 21 Oct 2026 03:06:24 +0000
State-Changed-Why:
pullup-11 #551
pullup-10 #1395


From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60554 CVS commit: [netbsd-11] src/sys/nfs
Date: Sun, 25 Oct 2026 10:40:43 +0000

 Module Name:	src
 Committed By:	martin
 Date:		Sun Oct 25 10:40:43 UTC 2026

 Modified Files:
 	src/sys/nfs [netbsd-11]: nfs_vnops.c

 Log Message:
 Pull up following revision(s) (requested by riastradh in ticket #551):

 	sys/nfs/nfs_vnops.c: revision 1.328
 	sys/nfs/nfs_vnops.c: revision 1.329

 nfs_vnops.c: Sort includes.

 No functional change intended.  Preparation for:
 PR kern/60554: nfs: integer shift UB in pathconf(_PC_FILESIZEBITS)

 nfs: Avoid UB in integer shift amounts.

 Just use ilog2 explicitly here, instead of writing out a loop with
 shifts and increments to compute it more slowly and buggily.  Note
 the confusing fencepost adjustment.  Clamp _PC_FILESIZEBITS at the
 actual size of off_t since we can't go beyond that.

 PR kern/60554: nfs: integer shift UB in pathconf(_PC_FILESIZEBITS)


 To generate a diff of this commit:
 cvs rdiff -u -r1.325.4.1 -r1.325.4.2 src/sys/nfs/nfs_vnops.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60554 CVS commit: [netbsd-10] src/sys/nfs
Date: Sun, 25 Oct 2026 10:44:04 +0000

 Module Name:	src
 Committed By:	martin
 Date:		Sun Oct 25 10:44:04 UTC 2026

 Modified Files:
 	src/sys/nfs [netbsd-10]: krpc.h nfs.h nfs_var.h nfs_vnops.c
 	    nfsdiskless.h nfsm_subs.h nfsmount.h nfsnode.h nfsproto.h nfsrtt.h
 	    nfsrvcache.h rpcv2.h xdr_subs.h

 Log Message:
 Pull up following revision(s) (requested by riastradh in ticket #1395):

 	sys/nfs/rpcv2.h: revision 1.13
 	sys/nfs/xdr_subs.h: revision 1.16
 	sys/nfs/krpc.h: revision 1.10
 	sys/nfs/nfs_vnops.c: revision 1.328
 	sys/nfs/nfs_vnops.c: revision 1.329
 	sys/nfs/nfsmount.h: revision 1.54
 	sys/nfs/nfsdiskless.h: revision 1.33
 	sys/nfs/nfsrvcache.h: revision 1.17
 	sys/nfs/nfsnode.h: revision 1.77
 	sys/nfs/nfs_var.h: revision 1.97
 	sys/nfs/nfs.h: revision 1.81
 	sys/nfs/nfsm_subs.h: revision 1.59
 	sys/nfs/nfsproto.h: revision 1.18
 	sys/nfs/nfsrtt.h: revision 1.11

 sys/nfs/nfs: Add some missing includes and include guards.

 Fix up some minor KNF issues while here.

 No functional change intended (except to enable things to build that
 might not have built before because of previously required #include
 ordering).

 nfs_vnops.c: Sort includes.

 No functional change intended.  Preparation for:
 PR kern/60554: nfs: integer shift UB in pathconf(_PC_FILESIZEBITS)

 nfs: Avoid UB in integer shift amounts.

 Just use ilog2 explicitly here, instead of writing out a loop with
 shifts and increments to compute it more slowly and buggily.  Note
 the confusing fencepost adjustment.  Clamp _PC_FILESIZEBITS at the
 actual size of off_t since we can't go beyond that.

 PR kern/60554: nfs: integer shift UB in pathconf(_PC_FILESIZEBITS)


 To generate a diff of this commit:
 cvs rdiff -u -r1.9 -r1.9.94.1 src/sys/nfs/krpc.h
 cvs rdiff -u -r1.80.4.1 -r1.80.4.2 src/sys/nfs/nfs.h
 cvs rdiff -u -r1.96 -r1.96.4.1 src/sys/nfs/nfs_var.h
 cvs rdiff -u -r1.324.4.2 -r1.324.4.3 src/sys/nfs/nfs_vnops.c
 cvs rdiff -u -r1.32 -r1.32.48.1 src/sys/nfs/nfsdiskless.h
 cvs rdiff -u -r1.55.4.1 -r1.55.4.2 src/sys/nfs/nfsm_subs.h
 cvs rdiff -u -r1.53 -r1.53.48.1 src/sys/nfs/nfsmount.h
 cvs rdiff -u -r1.76 -r1.76.4.1 src/sys/nfs/nfsnode.h
 cvs rdiff -u -r1.17 -r1.17.164.1 src/sys/nfs/nfsproto.h
 cvs rdiff -u -r1.10 -r1.10.50.1 src/sys/nfs/nfsrtt.h
 cvs rdiff -u -r1.16 -r1.16.134.1 src/sys/nfs/nfsrvcache.h
 cvs rdiff -u -r1.12 -r1.12.164.1 src/sys/nfs/rpcv2.h
 cvs rdiff -u -r1.15 -r1.15.194.1 src/sys/nfs/xdr_subs.h

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

>Unformatted:

Home	PR Database Search