From 744b4f9253e1740eb7454a9a33fa6d4b06920dcb Mon Sep 17 00:00:00 2001 From: Nathaniel Clark Date: Thu, 5 Jun 2014 15:59:55 -0400 Subject: [PATCH] LU-4984 llite: check for integer overflow in hsm user request Check to make sure total size of request does not overflow when calculated. Return -1 from hur_len() if it does overflow. Signed-off-by: Nathaniel Clark Change-Id: I6a3ca50c53ff38dab4165f20dac6fa00eb888df2 Reviewed-on: http://review.whamcloud.com/10615 Tested-by: Jenkins Reviewed-by: Andreas Dilger Reviewed-by: John L. Hammond Tested-by: Maloo --- lustre/include/lustre/lustre_user.h | 23 ++++++++++++++++++----- lustre/llite/dir.c | 4 +++- lustre/utils/lfs.c | 12 +++++++++++- 3 files changed, 32 insertions(+), 7 deletions(-) diff --git a/lustre/include/lustre/lustre_user.h b/lustre/include/lustre/lustre_user.h index e6f07c0..8b612a3 100644 --- a/lustre/include/lustre/lustre_user.h +++ b/lustre/include/lustre/lustre_user.h @@ -1049,12 +1049,25 @@ static inline void *hur_data(struct hsm_user_request *hur) return &(hur->hur_user_item[hur->hur_request.hr_itemcount]); } -/** Compute the current length of the provided hsm_user_request. */ -static inline int hur_len(struct hsm_user_request *hur) +/** + * Compute the current length of the provided hsm_user_request. This returns -1 + * instead of an errno because ssize_t is defined to be only [ -1, SSIZE_MAX ] + * + * return -1 on bounds check error. + */ +static inline ssize_t hur_len(struct hsm_user_request *hur) { - return offsetof(struct hsm_user_request, hur_user_item[0]) + - hur->hur_request.hr_itemcount * sizeof(hur->hur_user_item[0]) + - hur->hur_request.hr_data_len; + __u64 size; + + /* can't overflow a __u64 since hr_itemcount is only __u32 */ + size = offsetof(struct hsm_user_request, hur_user_item[0]) + + (__u64)hur->hur_request.hr_itemcount * + sizeof(hur->hur_user_item[0]) + hur->hur_request.hr_data_len; + + if (size != (ssize_t)size) + return -1; + + return size; } /****** HSM RPCs to copytool *****/ diff --git a/lustre/llite/dir.c b/lustre/llite/dir.c index 519e2dc..cea0dd3 100644 --- a/lustre/llite/dir.c +++ b/lustre/llite/dir.c @@ -1654,7 +1654,7 @@ out_rmdir: RETURN(ll_fid2path(inode, (void *)arg)); case LL_IOC_HSM_REQUEST: { struct hsm_user_request *hur; - int totalsize; + ssize_t totalsize; OBD_ALLOC_PTR(hur); if (hur == NULL) @@ -1669,6 +1669,8 @@ out_rmdir: /* Compute the whole struct size */ totalsize = hur_len(hur); OBD_FREE_PTR(hur); + if (totalsize < 0) + RETURN(-E2BIG); /* Final size will be more than double totalsize */ if (totalsize >= MDS_MAXREQSIZE / 3) diff --git a/lustre/utils/lfs.c b/lustre/utils/lfs.c index 57cac30..9c69498 100644 --- a/lustre/utils/lfs.c +++ b/lustre/utils/lfs.c @@ -3737,6 +3737,7 @@ static int lfs_hsm_request(int argc, char **argv, int action) /* If allocated buffer was too small, gets something * bigger */ if (nbfile_alloc <= hur->hur_request.hr_itemcount) { + ssize_t size; nbfile_alloc = nbfile_alloc * 2 + 1; oldhur = hur; hur = llapi_hsm_user_request_alloc(nbfile_alloc, @@ -3750,7 +3751,16 @@ static int lfs_hsm_request(int argc, char **argv, int action) fclose(fp); goto out_free; } - memcpy(hur, oldhur, hur_len(oldhur)); + size = hur_len(oldhur); + if (size < 0) { + fprintf(stderr, "Cannot allocate " + "the requested size\n"); + hur = oldhur; + rc = -E2BIG; + fclose(fp); + goto out_free; + } + memcpy(hur, oldhur, size); free(oldhur); } -- 1.8.3.1