Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6b2eb32e authored by Nathaniel Clark's avatar Nathaniel Clark Committed by Greg Kroah-Hartman
Browse files

staging/lustre/llite: check for integer overflow in hsm user request 



Check to make sure total size of request does not overflow when
calculated.  Return -1 from hur_len() if it does overflow.

Signed-off-by: default avatarNathaniel Clark <nathaniel.l.clark@intel.com>
Reviewed-on: http://review.whamcloud.com/10615
Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-4984


Reviewed-by: default avatarAndreas Dilger <andreas.dilger@intel.com>
Reviewed-by: default avatarJohn L. Hammond <john.hammond@intel.com>
Signed-off-by: default avatarOleg Drokin <oleg.drokin@intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent d41b7b74

drivers/staging/lustre/lustre/include/lustre/lustre_user.h

+18 −5
Original line number Original line Diff line number Diff line
@@ -997,12 +997,25 @@ static inline void *hur_data(struct hsm_user_request *hur) 
	return &(hur->hur_user_item[hur->hur_request.hr_itemcount]);

	return &(hur->hur_user_item[hur->hur_request.hr_itemcount]);

}

}





/** Compute the current length of the provided hsm_user_request. */

/**

static inline int hur_len(struct hsm_user_request *hur)

 * Compute the current length of the provided hsm_user_request.  This returns -1

 * instead of an errno because ssize_t is defined to be only [ -1, SSIZE_MAX ]

 *

 * return -1 on bounds check error.

 */

static inline ssize_t hur_len(struct hsm_user_request *hur)

{

{

	return offsetof(struct hsm_user_request,

	__u64	size;

			hur_user_item[hur->hur_request.hr_itemcount]) +



		hur->hur_request.hr_data_len;

	/* can't overflow a __u64 since hr_itemcount is only __u32 */

	size = offsetof(struct hsm_user_request, hur_user_item[0]) +

		(__u64)hur->hur_request.hr_itemcount *

		sizeof(hur->hur_user_item[0]) + hur->hur_request.hr_data_len;



	if (size != (ssize_t)size)

		return -1;



	return size;

}

}





/****** HSM RPCs to copytool *****/

/****** HSM RPCs to copytool *****/

drivers/staging/lustre/lustre/llite/dir.c

+3 −1
Original line number Original line Diff line number Diff line
@@ -1787,7 +1787,7 @@ static long ll_dir_ioctl(struct file *file, unsigned int cmd, unsigned long arg) 
		return ll_fid2path(inode, (void *)arg);

		return ll_fid2path(inode, (void *)arg);

	case LL_IOC_HSM_REQUEST: {

	case LL_IOC_HSM_REQUEST: {

		struct hsm_user_request	*hur;

		struct hsm_user_request	*hur;

		int			 totalsize;

		ssize_t			 totalsize;





		OBD_ALLOC_PTR(hur);

		OBD_ALLOC_PTR(hur);

		if (hur == NULL)

		if (hur == NULL)
@@ -1802,6 +1802,8 @@ static long ll_dir_ioctl(struct file *file, unsigned int cmd, unsigned long arg) 
		/* Compute the whole struct size */

		/* Compute the whole struct size */

		totalsize = hur_len(hur);

		totalsize = hur_len(hur);

		OBD_FREE_PTR(hur);

		OBD_FREE_PTR(hur);

		if (totalsize < 0)

			return -E2BIG;





		/* Final size will be more than double totalsize */

		/* Final size will be more than double totalsize */

		if (totalsize >= MDS_MAXREQSIZE / 3)

		if (totalsize >= MDS_MAXREQSIZE / 3)