staging: lustre: llite: validate names (d097d67b) · Commits · e / devices / android_kernel_oneplus_sm7250

drivers/staging/lustre/include/linux/libcfs/libcfs_private.h

+0 −9

Original line number	Original line	Diff line number	Diff line
	@@ -360,13 +360,4 @@ do { \
	ptr += cfs_size_round(len); \		ptr += cfs_size_round(len); \
	} while (0)		} while (0)

	#define LOGL0(var, len, ptr) \
	do { \
	if (!len) \
	break; \
	memcpy((char )ptr, (const char )var, len); \
	((char )(ptr) + len) = 0; \
	ptr += cfs_size_round(len + 1); \
	} while (0)

	#endif		#endif

drivers/staging/lustre/lustre/include/lu_object.h

+16 −0

Original line number	Original line	Diff line number	Diff line
	@@ -1262,6 +1262,22 @@ struct lu_name {
	int ln_namelen;		int ln_namelen;
	};		};

			/**
			* Validate names (path components)
			*
			* To be valid \a name must be non-empty, '\0' terminated of length \a
			* name_len, and not contain '/'. The maximum length of a name (before
			* say -ENAMETOOLONG will be returned) is really controlled by llite
			* and the server. We only check for something insane coming from bad
			* integer handling here.
			*/
			static inline bool lu_name_is_valid_2(const char *name, size_t name_len)
			{
			return name && name_len > 0 && name_len < INT_MAX &&
			name[name_len] == '\0' && strlen(name) == name_len &&
			!memchr(name, '/', name_len);
			}

	/**		/**
	* Common buffer structure to be passed around for various xattr_{s,g}et()		* Common buffer structure to be passed around for various xattr_{s,g}et()
	* methods.		* methods.

drivers/staging/lustre/lustre/llite/llite_lib.c

+11 −2

Original line number	Original line	Diff line number	Diff line
	@@ -2304,9 +2304,18 @@ struct md_op_data ll_prep_md_op_data(struct md_op_data op_data,
	const char *name, int namelen,		const char *name, int namelen,
	int mode, __u32 opc, void *data)		int mode, __u32 opc, void *data)
	{		{
			if (!name) {
			/* Do not reuse namelen for something else. */
			if (namelen)
			return ERR_PTR(-EINVAL);
			} else {
	if (namelen > ll_i2sbi(i1)->ll_namelen)		if (namelen > ll_i2sbi(i1)->ll_namelen)
	return ERR_PTR(-ENAMETOOLONG);		return ERR_PTR(-ENAMETOOLONG);

			if (!lu_name_is_valid_2(name, namelen))
			return ERR_PTR(-EINVAL);
			}

	if (!op_data)		if (!op_data)
	op_data = kzalloc(sizeof(*op_data), GFP_NOFS);		op_data = kzalloc(sizeof(*op_data), GFP_NOFS);

drivers/staging/lustre/lustre/mdc/mdc_lib.c

+43 −24

Original line number	Original line	Diff line number	Diff line
	@@ -87,6 +87,37 @@ void mdc_pack_body(struct ptlrpc_request req, const struct lu_fid fid,
	}		}
	}		}

			/**
			* Pack a name (path component) into a request
			*
			* \param[in] req request
			* \param[in] field request field (usually RMF_NAME)
			* \param[in] name path component
			* \param[in] name_len length of path component
			*
			* \a field must be present in \a req and of size \a name_len + 1.
			*
			* \a name must be '\0' terminated of length \a name_len and represent
			* a single path component (not contain '/').
			*/
			static void mdc_pack_name(struct ptlrpc_request *req,
			const struct req_msg_field *field,
			const char *name, size_t name_len)
			{
			size_t buf_size;
			size_t cpy_len;
			char *buf;

			buf = req_capsule_client_get(&req->rq_pill, field);
			buf_size = req_capsule_get_size(&req->rq_pill, field, RCL_CLIENT);

			LASSERT(name && name_len && buf && buf_size == name_len + 1);

			cpy_len = strlcpy(buf, name, buf_size);

			LASSERT(cpy_len == name_len && lu_name_is_valid_2(buf, cpy_len));
			}

	void mdc_readdir_pack(struct ptlrpc_request *req, __u64 pgoff,		void mdc_readdir_pack(struct ptlrpc_request *req, __u64 pgoff,
	__u32 size, const struct lu_fid *fid)		__u32 size, const struct lu_fid *fid)
	{		{
	@@ -130,9 +161,7 @@ void mdc_create_pack(struct ptlrpc_request req, struct md_op_data op_data,
	rec->cr_bias = op_data->op_bias;		rec->cr_bias = op_data->op_bias;
	rec->cr_umask = current_umask();		rec->cr_umask = current_umask();

	tmp = req_capsule_client_get(&req->rq_pill, &RMF_NAME);		mdc_pack_name(req, &RMF_NAME, op_data->op_name, op_data->op_namelen);
	LOGL0(op_data->op_name, op_data->op_namelen, tmp);

	if (data) {		if (data) {
	tmp = req_capsule_client_get(&req->rq_pill, &RMF_EADATA);		tmp = req_capsule_client_get(&req->rq_pill, &RMF_EADATA);
	memcpy(tmp, data, datalen);		memcpy(tmp, data, datalen);
	@@ -200,8 +229,9 @@ void mdc_open_pack(struct ptlrpc_request req, struct md_op_data op_data,
	rec->cr_old_handle = op_data->op_handle;		rec->cr_old_handle = op_data->op_handle;

	if (op_data->op_name) {		if (op_data->op_name) {
	tmp = req_capsule_client_get(&req->rq_pill, &RMF_NAME);		mdc_pack_name(req, &RMF_NAME, op_data->op_name,
	LOGL0(op_data->op_name, op_data->op_namelen, tmp);		op_data->op_namelen);

	if (op_data->op_bias & MDS_CREATE_VOLATILE)		if (op_data->op_bias & MDS_CREATE_VOLATILE)
	cr_flags \|= MDS_OPEN_VOLATILE;		cr_flags \|= MDS_OPEN_VOLATILE;
	}		}
	@@ -334,7 +364,6 @@ void mdc_setattr_pack(struct ptlrpc_request req, struct md_op_data op_data,
	void mdc_unlink_pack(struct ptlrpc_request req, struct md_op_data op_data)		void mdc_unlink_pack(struct ptlrpc_request req, struct md_op_data op_data)
	{		{
	struct mdt_rec_unlink *rec;		struct mdt_rec_unlink *rec;
	char *tmp;

	CLASSERT(sizeof(struct mdt_rec_reint) == sizeof(struct mdt_rec_unlink));		CLASSERT(sizeof(struct mdt_rec_reint) == sizeof(struct mdt_rec_unlink));
	rec = req_capsule_client_get(&req->rq_pill, &RMF_REC_REINT);		rec = req_capsule_client_get(&req->rq_pill, &RMF_REC_REINT);
	@@ -352,15 +381,12 @@ void mdc_unlink_pack(struct ptlrpc_request req, struct md_op_data op_data)
	rec->ul_time = op_data->op_mod_time;		rec->ul_time = op_data->op_mod_time;
	rec->ul_bias = op_data->op_bias;		rec->ul_bias = op_data->op_bias;

	tmp = req_capsule_client_get(&req->rq_pill, &RMF_NAME);		mdc_pack_name(req, &RMF_NAME, op_data->op_name, op_data->op_namelen);
	LASSERT(tmp);
	LOGL0(op_data->op_name, op_data->op_namelen, tmp);
	}		}

	void mdc_link_pack(struct ptlrpc_request req, struct md_op_data op_data)		void mdc_link_pack(struct ptlrpc_request req, struct md_op_data op_data)
	{		{
	struct mdt_rec_link *rec;		struct mdt_rec_link *rec;
	char *tmp;

	CLASSERT(sizeof(struct mdt_rec_reint) == sizeof(struct mdt_rec_link));		CLASSERT(sizeof(struct mdt_rec_reint) == sizeof(struct mdt_rec_link));
	rec = req_capsule_client_get(&req->rq_pill, &RMF_REC_REINT);		rec = req_capsule_client_get(&req->rq_pill, &RMF_REC_REINT);
	@@ -376,15 +402,13 @@ void mdc_link_pack(struct ptlrpc_request req, struct md_op_data op_data)
	rec->lk_time = op_data->op_mod_time;		rec->lk_time = op_data->op_mod_time;
	rec->lk_bias = op_data->op_bias;		rec->lk_bias = op_data->op_bias;

	tmp = req_capsule_client_get(&req->rq_pill, &RMF_NAME);		mdc_pack_name(req, &RMF_NAME, op_data->op_name, op_data->op_namelen);
	LOGL0(op_data->op_name, op_data->op_namelen, tmp);
	}		}

	void mdc_rename_pack(struct ptlrpc_request req, struct md_op_data op_data,		void mdc_rename_pack(struct ptlrpc_request req, struct md_op_data op_data,
	const char old, int oldlen, const char new, int newlen)		const char old, int oldlen, const char new, int newlen)
	{		{
	struct mdt_rec_rename *rec;		struct mdt_rec_rename *rec;
	char *tmp;

	CLASSERT(sizeof(struct mdt_rec_reint) == sizeof(struct mdt_rec_rename));		CLASSERT(sizeof(struct mdt_rec_reint) == sizeof(struct mdt_rec_rename));
	rec = req_capsule_client_get(&req->rq_pill, &RMF_REC_REINT);		rec = req_capsule_client_get(&req->rq_pill, &RMF_REC_REINT);
	@@ -404,13 +428,10 @@ void mdc_rename_pack(struct ptlrpc_request req, struct md_op_data op_data,
	rec->rn_mode = op_data->op_mode;		rec->rn_mode = op_data->op_mode;
	rec->rn_bias = op_data->op_bias;		rec->rn_bias = op_data->op_bias;

	tmp = req_capsule_client_get(&req->rq_pill, &RMF_NAME);		mdc_pack_name(req, &RMF_NAME, old, oldlen);
	LOGL0(old, oldlen, tmp);

	if (new) {		if (new)
	tmp = req_capsule_client_get(&req->rq_pill, &RMF_SYMTGT);		mdc_pack_name(req, &RMF_SYMTGT, new, newlen);
	LOGL0(new, newlen, tmp);
	}
	}		}

	void mdc_getattr_pack(struct ptlrpc_request *req, __u64 valid, int flags,		void mdc_getattr_pack(struct ptlrpc_request *req, __u64 valid, int flags,
	@@ -432,11 +453,9 @@ void mdc_getattr_pack(struct ptlrpc_request *req, __u64 valid, int flags,
	b->fid2 = op_data->op_fid2;		b->fid2 = op_data->op_fid2;
	b->valid \|= OBD_MD_FLID;		b->valid \|= OBD_MD_FLID;

	if (op_data->op_name) {		if (op_data->op_name)
	char *tmp = req_capsule_client_get(&req->rq_pill, &RMF_NAME);		mdc_pack_name(req, &RMF_NAME, op_data->op_name,
			op_data->op_namelen);
	LOGL0(op_data->op_name, op_data->op_namelen, tmp);
	}
	}		}

	static void mdc_hsm_release_pack(struct ptlrpc_request *req,		static void mdc_hsm_release_pack(struct ptlrpc_request *req,