LU-4984 llite: check for integer overflow in hsm user request

[fs/lustre-release.git] / lustre / include / lustre / lustre_user.h

diff --git a/lustre/include/lustre/lustre_user.h b/lustre/include/lustre/lustre_user.h
index e385612..8b612a3 100644 (file)
--- a/lustre/include/lustre/lustre_user.h
+++ b/lustre/include/lustre/lustre_user.h
@@ -405,6 +405,7 @@ struct lmv_user_mds_data {
 };
 
 enum lmv_hash_type {
+       LMV_HASH_TYPE_UNKNOWN   = 0,    /* 0 is reserved for testing purpose */
        LMV_HASH_TYPE_ALL_CHARS = 1,
        LMV_HASH_TYPE_FNV_1A_64 = 2,
 };
@@ -498,8 +499,8 @@ static inline void obd_uuid2fsname(char *buf, char *uuid, int buflen)
         strncpy(buf, uuid, buflen - 1);
         buf[buflen - 1] = '\0';
         p = strrchr(buf, '-');
-        if (p)
-           *p = '\0';
+       if (p != NULL)
+               *p = '\0';
 }
 
 /* printf display format
@@ -1048,12 +1049,25 @@ static inline void *hur_data(struct hsm_user_request *hur)
        return &(hur->hur_user_item[hur->hur_request.hr_itemcount]);
 }
 
-/** Compute the current length of the provided hsm_user_request. */
-static inline int hur_len(struct hsm_user_request *hur)
+/**
+ * Compute the current length of the provided hsm_user_request.  This returns -1
+ * instead of an errno because ssize_t is defined to be only [ -1, SSIZE_MAX ]
+ *
+ * return -1 on bounds check error.
+ */
+static inline ssize_t hur_len(struct hsm_user_request *hur)
 {
-       return offsetof(struct hsm_user_request, hur_user_item[0]) +
-               hur->hur_request.hr_itemcount * sizeof(hur->hur_user_item[0]) +
-               hur->hur_request.hr_data_len;
+       __u64   size;
+
+       /* can't overflow a __u64 since hr_itemcount is only __u32 */
+       size = offsetof(struct hsm_user_request, hur_user_item[0]) +
+               (__u64)hur->hur_request.hr_itemcount *
+               sizeof(hur->hur_user_item[0]) + hur->hur_request.hr_data_len;
+
+       if (size != (ssize_t)size)
+               return -1;
+
+       return size;
 }
 
 /****** HSM RPCs to copytool *****/