LU-17000 mdt: symbolic link integer overflow

CoverityID: 442376 ("Integer overflow")
Use ssize_t to avoid narrowing

CoverityID: 442114 ("Integer handling issues")
mdt_getattr_internal() a theoretical underflow when subtracting
from an unsigned int that could be 0

Signed-off-by: Shaun Tancheff <shaun.tancheff@hpe.com>
Change-Id: I560c9cbcbfed907725b101ca90661fe8d0d6cf45
Reviewed-on: https://review.whamcloud.com/c/fs/lustre-release/+/56151
Tested-by: jenkins <devops@whamcloud.com>
Tested-by: Maloo <maloo@whamcloud.com>
Reviewed-by: Oleg Drokin <green@whamcloud.com>
Reviewed-by: Andreas Dilger <adilger@whamcloud.com>
Reviewed-by: Arshad Hussain <arshad.hussain@aeoncomputing.com>

diff --git a/lustre/llite/file.c b/lustre/llite/file.c
index 69edde8..bc0620e 100644 (file)
--- a/lustre/llite/file.c
+++ b/lustre/llite/file.c
@@ -646,7 +646,7 @@ out_io:
        EXIT;
 }
 
-static int ll_intent_file_open(struct dentry *de, void *lmm, int lmmsize,
+static int ll_intent_file_open(struct dentry *de, void *lmm, ssize_t lmmsize,
                                struct lookup_intent *itp)
 {
        struct ll_sb_info *sbi = ll_i2sbi(de->d_inode);
@@ -2684,7 +2684,8 @@ static ssize_t ll_file_write(struct file *file, const char __user *buf,
 #endif /* !HAVE_FILE_OPERATIONS_READ_WRITE_ITER */
 
 int ll_lov_setstripe_ea_info(struct inode *inode, struct dentry *dentry,
-                            __u64 flags, struct lov_user_md *lum, int lum_size)
+                            __u64 flags, struct lov_user_md *lum,
+                            ssize_t lum_size)
 {
        struct lookup_intent oit = {
                .it_op = IT_OPEN,
@@ -2864,7 +2865,7 @@ static int ll_lov_setea(struct inode *inode, struct file *file,
 {
        __u64 flags = MDS_OPEN_HAS_OBJS | FMODE_WRITE;
        struct lov_user_md *lump;
-       int lum_size = sizeof(*lump) + sizeof(struct lov_user_ost_data);
+       ssize_t lum_size = sizeof(*lump) + sizeof(struct lov_user_ost_data);
        int rc;
 
        ENTRY;
@@ -2907,20 +2908,20 @@ static int ll_file_getstripe(struct inode *inode, void __user *lum, size_t size)
        RETURN(rc);
 }
 
-static int ll_lov_setstripe(struct inode *inode, struct file *file,
+static ssize_t ll_lov_setstripe(struct inode *inode, struct file *file,
                            void __user *arg)
 {
        struct lov_user_md __user *lum = arg;
        struct lov_user_md *klum;
-       int lum_size, rc;
+       ssize_t lum_size;
+       int rc;
        __u64 flags = FMODE_WRITE;
 
        ENTRY;
-       rc = ll_copy_user_md(lum, &klum);
-       if (rc < 0)
-               RETURN(rc);
+       lum_size = ll_copy_user_md(lum, &klum);
+       if (lum_size < 0)
+               RETURN(lum_size);
 
-       lum_size = rc;
        rc = ll_lov_setstripe_ea_info(inode, file_dentry(file), flags, klum,
                                      lum_size);
        if (!rc) {

diff --git a/lustre/llite/llite_internal.h b/lustre/llite/llite_internal.h
index 3bc2172..de159a8 100644 (file)
--- a/lustre/llite/llite_internal.h
+++ b/lustre/llite/llite_internal.h
@@ -1463,7 +1463,7 @@ int ll_ioctl_ahead(struct file *file, struct llapi_lu_ladvise2 *ladvise);
 
 int ll_lov_setstripe_ea_info(struct inode *inode, struct dentry *dentry,
                             __u64 flags, struct lov_user_md *lum,
-                            int lum_size);
+                            ssize_t lum_size);
 int ll_lov_getstripe_ea_info(struct inode *inode, const char *filename,
                             struct lov_mds_md **lmm, int *lmm_size,
                             struct ptlrpc_request **request);

diff --git a/lustre/mdt/mdt_handler.c b/lustre/mdt/mdt_handler.c
index 9f1dbd1..2ef2755 100644 (file)
--- a/lustre/mdt/mdt_handler.c
+++ b/lustre/mdt/mdt_handler.c
@@ -1615,7 +1615,9 @@ static int mdt_getattr_internal(struct mdt_thread_info *info,
                /* eadatasize from client includes NULL-terminator, so
                 * there is no need to read it
                 */
-               buffer->lb_len = reqbody->mbo_eadatasize - 1;
+               buffer->lb_len = 0;
+               if (reqbody->mbo_eadatasize > 0)
+                       buffer->lb_len = reqbody->mbo_eadatasize - 1;
                rc = mo_readlink(env, next, buffer);
                if (unlikely(rc <= 0)) {
                        CERROR("%s: readlink failed for "DFID": rc = %d\n",