From 149f005a3199eee13fe6396671613a0f620ee0cc Mon Sep 17 00:00:00 2001 From: Emoly Liu Date: Fri, 9 Aug 2019 15:29:30 +0800 Subject: [PATCH] LU-12605 tgt: check client data size in target_handle_connect() Check client data size (negtive or excessively large) in case of memcpy corruption. Change-Id: Ided26dea0e2bbb79e607c626810834ca947497d4 Reported-by: Alibaba Cloud Signed-off-by: Emoly Liu Reviewed-on: https://review.whamcloud.com/35711 Reviewed-by: Andreas Dilger Tested-by: jenkins Tested-by: Maloo Reviewed-by: Patrick Farrell Reviewed-by: Oleg Drokin --- lustre/ldlm/ldlm_lib.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lustre/ldlm/ldlm_lib.c b/lustre/ldlm/ldlm_lib.c index 68042ce..ddc3715 100644 --- a/lustre/ldlm/ldlm_lib.c +++ b/lustre/ldlm/ldlm_lib.c @@ -1087,6 +1087,8 @@ int target_handle_connect(struct ptlrpc_request *req) size = req_capsule_get_size(&req->rq_pill, &RMF_CONNECT_DATA, RCL_CLIENT); + if (size < 0 || size > 8 * sizeof(struct obd_connect_data)) + GOTO(out, rc = -EPROTO); data = req_capsule_client_get(&req->rq_pill, &RMF_CONNECT_DATA); if (!data) GOTO(out, rc = -EPROTO); -- 1.8.3.1