Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 661489ad authored by Sebastien Buisson's avatar Sebastien Buisson Committed by Greg Kroah-Hartman
Browse files

staging: lustre: fix 'copy into fixed size buffer' errors 



Fix 'copy into fixed size buffer' defects found by Coverity
version 6.0.3:
Copy into fixed size buffer (STRING_OVERFLOW)
The fixed-size string might be overrun by copying without
checking the length.

Signed-off-by: default avatarSebastien Buisson <sebastien.buisson@bull.net>
Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-2074
Reviewed-on: http://review.whamcloud.com/4154


Reviewed-by: default avatarDmitry Eremin <dmitry.eremin@intel.com>
Reviewed-by: default avatarOleg Drokin <oleg.drokin@intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 5412d816

drivers/staging/lustre/lnet/lnet/lib-socket.c

+12 −3
Original line number Diff line number Diff line
@@ -99,7 +99,10 @@ lnet_ipif_query(char *name, int *up, __u32 *ip, __u32 *mask) 


	CLASSERT(sizeof(ifr.ifr_name) >= IFNAMSIZ);



	strcpy(ifr.ifr_name, name);

	if (strlen(name) > sizeof(ifr.ifr_name) - 1)

		return -E2BIG;

	strncpy(ifr.ifr_name, name, sizeof(ifr.ifr_name));



	rc = lnet_sock_ioctl(SIOCGIFFLAGS, (unsigned long)&ifr);

	if (rc) {

		CERROR("Can't get flags for interface %s\n", name);
@@ -114,7 +117,10 @@ lnet_ipif_query(char *name, int *up, __u32 *ip, __u32 *mask) 
	}

	*up = 1;



	strcpy(ifr.ifr_name, name);

	if (strlen(name) > sizeof(ifr.ifr_name) - 1)

		return -E2BIG;

	strncpy(ifr.ifr_name, name, sizeof(ifr.ifr_name));



	ifr.ifr_addr.sa_family = AF_INET;

	rc = lnet_sock_ioctl(SIOCGIFADDR, (unsigned long)&ifr);

	if (rc) {
@@ -125,7 +131,10 @@ lnet_ipif_query(char *name, int *up, __u32 *ip, __u32 *mask) 
	val = ((struct sockaddr_in *)&ifr.ifr_addr)->sin_addr.s_addr;

	*ip = ntohl(val);



	strcpy(ifr.ifr_name, name);

	if (strlen(name) > sizeof(ifr.ifr_name) - 1)

		return -E2BIG;

	strncpy(ifr.ifr_name, name, sizeof(ifr.ifr_name));



	ifr.ifr_addr.sa_family = AF_INET;

	rc = lnet_sock_ioctl(SIOCGIFNETMASK, (unsigned long)&ifr);

	if (rc) {

drivers/staging/lustre/lnet/selftest/console.c

+19 −4
Original line number Diff line number Diff line
@@ -206,8 +206,14 @@ lstcon_group_alloc(char *name, lstcon_group_t **grpp) 
		return -ENOMEM;



	grp->grp_ref = 1;

	if (name)

		strcpy(grp->grp_name, name);

	if (name) {

		if (strlen(name) > sizeof(grp->grp_name)-1) {

			LIBCFS_FREE(grp, offsetof(lstcon_group_t,

				    grp_ndl_hash[LST_NODE_HASHSIZE]));

			return -E2BIG;

		}

		strncpy(grp->grp_name, name, sizeof(grp->grp_name));

	}



	INIT_LIST_HEAD(&grp->grp_link);

	INIT_LIST_HEAD(&grp->grp_ndl_list);
@@ -873,7 +879,13 @@ lstcon_batch_add(char *name) 
		return -ENOMEM;

	}



	strcpy(bat->bat_name, name);

	if (strlen(name) > sizeof(bat->bat_name) - 1) {

		LIBCFS_FREE(bat->bat_srv_hash, LST_NODE_HASHSIZE);

		LIBCFS_FREE(bat->bat_cli_hash, LST_NODE_HASHSIZE);

		LIBCFS_FREE(bat, sizeof(lstcon_batch_t));

		return -E2BIG;

	}

	strncpy(bat->bat_name, name, sizeof(bat->bat_name));

	bat->bat_hdr.tsb_index = 0;

	bat->bat_hdr.tsb_id.bat_id = ++console_session.ses_id_cookie;
@@ -1733,7 +1745,10 @@ lstcon_session_new(char *name, int key, unsigned feats, 
	console_session.ses_feats_updated = 0;

	console_session.ses_timeout = (timeout <= 0) ?

				      LST_CONSOLE_TIMEOUT : timeout;

	strlcpy(console_session.ses_name, name,



	if (strlen(name) > sizeof(console_session.ses_name)-1)

		return -E2BIG;

	strncpy(console_session.ses_name, name,

		sizeof(console_session.ses_name));



	rc = lstcon_batch_add(LST_DEFAULT_BATCH);

drivers/staging/lustre/lustre/libcfs/workitem.c

+5 −1
Original line number Diff line number Diff line
@@ -351,7 +351,11 @@ cfs_wi_sched_create(char *name, struct cfs_cpt_table *cptab, 
	if (!sched)

		return -ENOMEM;



	strlcpy(sched->ws_name, name, CFS_WS_NAME_LEN);

	if (strlen(name) > sizeof(sched->ws_name) - 1) {

		LIBCFS_FREE(sched, sizeof(*sched));

		return -E2BIG;

	}

	strncpy(sched->ws_name, name, sizeof(sched->ws_name));



	sched->ws_cptab = cptab;

	sched->ws_cpt = cpt;

drivers/staging/lustre/lustre/ptlrpc/nrs.c

+7 −1
Original line number Diff line number Diff line
@@ -1094,6 +1094,7 @@ static int ptlrpc_nrs_policy_register(struct ptlrpc_nrs_pol_conf *conf) 
{

	struct ptlrpc_service *svc;

	struct ptlrpc_nrs_pol_desc *desc;

	size_t len;

	int rc = 0;



	LASSERT(conf->nc_ops);
@@ -1137,7 +1138,12 @@ static int ptlrpc_nrs_policy_register(struct ptlrpc_nrs_pol_conf *conf) 
		goto fail;

	}



	strncpy(desc->pd_name, conf->nc_name, NRS_POL_NAME_MAX);

	len = strlcpy(desc->pd_name, conf->nc_name, sizeof(desc->pd_name));

	if (len >= sizeof(desc->pd_name)) {

		kfree(desc);

		rc = -E2BIG;

		goto fail;

	}

	desc->pd_ops = conf->nc_ops;

	desc->pd_compat = conf->nc_compat;

	desc->pd_compat_svc_name = conf->nc_compat_svc_name;

drivers/staging/lustre/lustre/ptlrpc/sec_config.c

+6 −1
Original line number Diff line number Diff line
@@ -517,6 +517,7 @@ struct sptlrpc_conf *sptlrpc_conf_get(const char *fsname, 
				      int create)

{

	struct sptlrpc_conf *conf;

	size_t len;



	list_for_each_entry(conf, &sptlrpc_confs, sc_list) {

		if (strcmp(conf->sc_fsname, fsname) == 0)
@@ -530,7 +531,11 @@ struct sptlrpc_conf *sptlrpc_conf_get(const char *fsname, 
	if (!conf)

		return NULL;



	strcpy(conf->sc_fsname, fsname);

	len = strlcpy(conf->sc_fsname, fsname, sizeof(conf->sc_fsname));

	if (len >= sizeof(conf->sc_fsname)) {

		kfree(conf);

		return NULL;

	}

	sptlrpc_rule_set_init(&conf->sc_rset);

	INIT_LIST_HEAD(&conf->sc_tgts);

	list_add(&conf->sc_list, &sptlrpc_confs);