LU-4423 llite: Integer overflow in ll_ioctl_fiemap

[fs/lustre-release.git] / lustre / llite / file.c

diff --git a/lustre/llite/file.c b/lustre/llite/file.c
index 52fc9ff..b29a9c6 100644 (file)
--- a/lustre/llite/file.c
+++ b/lustre/llite/file.c
@@ -1913,6 +1913,9 @@ int ll_fid2path(struct inode *inode, void __user *arg)
        if (get_user(pathlen, &gfin->gf_pathlen))
                RETURN(-EFAULT);
 
+       if (pathlen > PATH_MAX)
+               RETURN(-EINVAL);
+
        outsize = sizeof(*gfout) + pathlen;
        OBD_ALLOC(gfout, outsize);
        if (gfout == NULL)
@@ -1946,6 +1949,10 @@ static int ll_ioctl_fiemap(struct inode *inode, unsigned long arg)
         if (get_user(extent_count,
             &((struct ll_user_fiemap __user *)arg)->fm_extent_count))
                 RETURN(-EFAULT);
+
+       if (extent_count >=
+           (SIZE_MAX - sizeof(*fiemap_s)) / sizeof(struct ll_fiemap_extent))
+               RETURN(-EINVAL);
         num_bytes = sizeof(*fiemap_s) + (extent_count *
                                          sizeof(struct ll_fiemap_extent));
 
@@ -2306,10 +2313,14 @@ static int ll_hsm_import(struct inode *inode, struct file *file,
                         ATTR_MTIME | ATTR_MTIME_SET |
                         ATTR_ATIME | ATTR_ATIME_SET;
 
+       mutex_lock(&inode->i_mutex);
+
        rc = ll_setattr_raw(file->f_dentry, attr, true);
        if (rc == -ENODATA)
                rc = 0;
 
+       mutex_unlock(&inode->i_mutex);
+
 out:
        if (hss != NULL)
                OBD_FREE_PTR(hss);
@@ -2320,6 +2331,12 @@ out:
        RETURN(rc);
 }
 
+static inline long ll_lease_type_from_fmode(fmode_t fmode)
+{
+       return ((fmode & FMODE_READ) ? LL_LEASE_RDLCK : 0) |
+              ((fmode & FMODE_WRITE) ? LL_LEASE_WRLCK : 0);
+}
+
 static long
 ll_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
@@ -2530,20 +2547,20 @@ ll_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                struct ll_inode_info *lli = ll_i2info(inode);
                struct obd_client_handle *och = NULL;
                bool lease_broken;
-               fmode_t mode = 0;
+               fmode_t fmode;
 
                switch (arg) {
-               case F_WRLCK:
+               case LL_LEASE_WRLCK:
                        if (!(file->f_mode & FMODE_WRITE))
                                RETURN(-EPERM);
-                       mode = FMODE_WRITE;
+                       fmode = FMODE_WRITE;
                        break;
-               case F_RDLCK:
+               case LL_LEASE_RDLCK:
                        if (!(file->f_mode & FMODE_READ))
                                RETURN(-EPERM);
-                       mode = FMODE_READ;
+                       fmode = FMODE_READ;
                        break;
-               case F_UNLCK:
+               case LL_LEASE_UNLCK:
                        mutex_lock(&lli->lli_och_mutex);
                        if (fd->fd_lease_och != NULL) {
                                och = fd->fd_lease_och;
@@ -2551,25 +2568,26 @@ ll_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                        }
                        mutex_unlock(&lli->lli_och_mutex);
 
-                       if (och != NULL) {
-                               mode = och->och_flags &(FMODE_READ|FMODE_WRITE);
-                               rc = ll_lease_close(och, inode, &lease_broken);
-                               if (rc == 0 && lease_broken)
-                                       mode = 0;
-                       } else {
-                               rc = -ENOLCK;
-                       }
+                       if (och == NULL)
+                               RETURN(-ENOLCK);
+
+                       fmode = och->och_flags;
+                       rc = ll_lease_close(och, inode, &lease_broken);
+                       if (rc < 0)
+                               RETURN(rc);
 
-                       /* return the type of lease or error */
-                       RETURN(rc < 0 ? rc : (int)mode);
+                       if (lease_broken)
+                               fmode = 0;
+
+                       RETURN(ll_lease_type_from_fmode(fmode));
                default:
                        RETURN(-EINVAL);
                }
 
-               CDEBUG(D_INODE, "Set lease with mode %d\n", mode);
+               CDEBUG(D_INODE, "Set lease with mode %u\n", fmode);
 
                /* apply for lease */
-               och = ll_lease_open(inode, file, mode, 0);
+               och = ll_lease_open(inode, file, fmode, 0);
                if (IS_ERR(och))
                        RETURN(PTR_ERR(och));
 
@@ -2590,8 +2608,8 @@ ll_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
        case LL_IOC_GET_LEASE: {
                struct ll_inode_info *lli = ll_i2info(inode);
                struct ldlm_lock *lock = NULL;
+               fmode_t fmode = 0;
 
-               rc = 0;
                mutex_lock(&lli->lli_och_mutex);
                if (fd->fd_lease_och != NULL) {
                        struct obd_client_handle *och = fd->fd_lease_och;
@@ -2600,14 +2618,15 @@ ll_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                        if (lock != NULL) {
                                lock_res_and_lock(lock);
                                if (!ldlm_is_cancel(lock))
-                                       rc = och->och_flags &
-                                               (FMODE_READ | FMODE_WRITE);
+                                       fmode = och->och_flags;
+
                                unlock_res_and_lock(lock);
                                LDLM_LOCK_PUT(lock);
                        }
                }
                mutex_unlock(&lli->lli_och_mutex);
-               RETURN(rc);
+
+               RETURN(ll_lease_type_from_fmode(fmode));
        }
        case LL_IOC_HSM_IMPORT: {
                struct hsm_user_import *hui;