LU-4423 llite: Integer overflow in ll_ioctl_fiemap

[fs/lustre-release.git] / lustre / llite / file.c

diff --git a/lustre/llite/file.c b/lustre/llite/file.c
index 6582be3..b29a9c6 100644 (file)
--- a/lustre/llite/file.c
+++ b/lustre/llite/file.c
@@ -666,8 +666,9 @@ restart:
                        /*
                         * Normally called under two situations:
                         * 1. NFS export.
-                        * 2. revalidate with IT_OPEN (revalidate doesn't
-                        *    execute this intent any more).
+                        * 2. A race/condition on MDS resulting in no open
+                        *    handle to be returned from LOOKUP|OPEN request,
+                        *    for example if the target entry was a symlink.
                         *
                         * Always fetch MDS_OPEN_LOCK if this is not setstripe.
                         *
@@ -1893,38 +1894,39 @@ out:
        RETURN(rc);
 }
 
-int ll_fid2path(struct inode *inode, void *arg)
+int ll_fid2path(struct inode *inode, void __user *arg)
 {
        struct obd_export       *exp = ll_i2mdexp(inode);
-       struct getinfo_fid2path *gfout, *gfin;
-       int                      outsize, rc;
+       const struct getinfo_fid2path __user *gfin = arg;
+       __u32                    pathlen;
+       struct getinfo_fid2path *gfout;
+       size_t                   outsize;
+       int                      rc;
+
        ENTRY;
 
        if (!cfs_capable(CFS_CAP_DAC_READ_SEARCH) &&
            !(ll_i2sbi(inode)->ll_flags & LL_SBI_USER_FID2PATH))
                RETURN(-EPERM);
 
-       /* Need to get the buflen */
-       OBD_ALLOC_PTR(gfin);
-       if (gfin == NULL)
-               RETURN(-ENOMEM);
-       if (copy_from_user(gfin, arg, sizeof(*gfin))) {
-               OBD_FREE_PTR(gfin);
+       /* Only need to get the buflen */
+       if (get_user(pathlen, &gfin->gf_pathlen))
                RETURN(-EFAULT);
-       }
 
-       outsize = sizeof(*gfout) + gfin->gf_pathlen;
+       if (pathlen > PATH_MAX)
+               RETURN(-EINVAL);
+
+       outsize = sizeof(*gfout) + pathlen;
        OBD_ALLOC(gfout, outsize);
-       if (gfout == NULL) {
-               OBD_FREE_PTR(gfin);
+       if (gfout == NULL)
                RETURN(-ENOMEM);
-       }
-       memcpy(gfout, gfin, sizeof(*gfout));
-       OBD_FREE_PTR(gfin);
+
+       if (copy_from_user(gfout, arg, sizeof(*gfout)))
+               GOTO(gf_free, rc = -EFAULT);
 
        /* Call mdc_iocontrol */
        rc = obd_iocontrol(OBD_IOC_FID2PATH, exp, outsize, gfout, NULL);
-       if (rc)
+       if (rc != 0)
                GOTO(gf_free, rc);
 
        if (copy_to_user(arg, gfout, outsize))
@@ -1947,6 +1949,10 @@ static int ll_ioctl_fiemap(struct inode *inode, unsigned long arg)
         if (get_user(extent_count,
             &((struct ll_user_fiemap __user *)arg)->fm_extent_count))
                 RETURN(-EFAULT);
+
+       if (extent_count >=
+           (SIZE_MAX - sizeof(*fiemap_s)) / sizeof(struct ll_fiemap_extent))
+               RETURN(-EINVAL);
         num_bytes = sizeof(*fiemap_s) + (extent_count *
                                          sizeof(struct ll_fiemap_extent));
 
@@ -2307,10 +2313,14 @@ static int ll_hsm_import(struct inode *inode, struct file *file,
                         ATTR_MTIME | ATTR_MTIME_SET |
                         ATTR_ATIME | ATTR_ATIME_SET;
 
+       mutex_lock(&inode->i_mutex);
+
        rc = ll_setattr_raw(file->f_dentry, attr, true);
        if (rc == -ENODATA)
                rc = 0;
 
+       mutex_unlock(&inode->i_mutex);
+
 out:
        if (hss != NULL)
                OBD_FREE_PTR(hss);
@@ -2321,6 +2331,12 @@ out:
        RETURN(rc);
 }
 
+static inline long ll_lease_type_from_fmode(fmode_t fmode)
+{
+       return ((fmode & FMODE_READ) ? LL_LEASE_RDLCK : 0) |
+              ((fmode & FMODE_WRITE) ? LL_LEASE_WRLCK : 0);
+}
+
 static long
 ll_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
@@ -2531,20 +2547,20 @@ ll_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                struct ll_inode_info *lli = ll_i2info(inode);
                struct obd_client_handle *och = NULL;
                bool lease_broken;
-               fmode_t mode = 0;
+               fmode_t fmode;
 
                switch (arg) {
-               case F_WRLCK:
+               case LL_LEASE_WRLCK:
                        if (!(file->f_mode & FMODE_WRITE))
                                RETURN(-EPERM);
-                       mode = FMODE_WRITE;
+                       fmode = FMODE_WRITE;
                        break;
-               case F_RDLCK:
+               case LL_LEASE_RDLCK:
                        if (!(file->f_mode & FMODE_READ))
                                RETURN(-EPERM);
-                       mode = FMODE_READ;
+                       fmode = FMODE_READ;
                        break;
-               case F_UNLCK:
+               case LL_LEASE_UNLCK:
                        mutex_lock(&lli->lli_och_mutex);
                        if (fd->fd_lease_och != NULL) {
                                och = fd->fd_lease_och;
@@ -2552,25 +2568,26 @@ ll_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                        }
                        mutex_unlock(&lli->lli_och_mutex);
 
-                       if (och != NULL) {
-                               mode = och->och_flags &(FMODE_READ|FMODE_WRITE);
-                               rc = ll_lease_close(och, inode, &lease_broken);
-                               if (rc == 0 && lease_broken)
-                                       mode = 0;
-                       } else {
-                               rc = -ENOLCK;
-                       }
+                       if (och == NULL)
+                               RETURN(-ENOLCK);
 
-                       /* return the type of lease or error */
-                       RETURN(rc < 0 ? rc : (int)mode);
+                       fmode = och->och_flags;
+                       rc = ll_lease_close(och, inode, &lease_broken);
+                       if (rc < 0)
+                               RETURN(rc);
+
+                       if (lease_broken)
+                               fmode = 0;
+
+                       RETURN(ll_lease_type_from_fmode(fmode));
                default:
                        RETURN(-EINVAL);
                }
 
-               CDEBUG(D_INODE, "Set lease with mode %d\n", mode);
+               CDEBUG(D_INODE, "Set lease with mode %u\n", fmode);
 
                /* apply for lease */
-               och = ll_lease_open(inode, file, mode, 0);
+               och = ll_lease_open(inode, file, fmode, 0);
                if (IS_ERR(och))
                        RETURN(PTR_ERR(och));
 
@@ -2591,8 +2608,8 @@ ll_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
        case LL_IOC_GET_LEASE: {
                struct ll_inode_info *lli = ll_i2info(inode);
                struct ldlm_lock *lock = NULL;
+               fmode_t fmode = 0;
 
-               rc = 0;
                mutex_lock(&lli->lli_och_mutex);
                if (fd->fd_lease_och != NULL) {
                        struct obd_client_handle *och = fd->fd_lease_och;
@@ -2601,14 +2618,15 @@ ll_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                        if (lock != NULL) {
                                lock_res_and_lock(lock);
                                if (!ldlm_is_cancel(lock))
-                                       rc = och->och_flags &
-                                               (FMODE_READ | FMODE_WRITE);
+                                       fmode = och->och_flags;
+
                                unlock_res_and_lock(lock);
                                LDLM_LOCK_PUT(lock);
                        }
                }
                mutex_unlock(&lli->lli_och_mutex);
-               RETURN(rc);
+
+               RETURN(ll_lease_type_from_fmode(fmode));
        }
        case LL_IOC_HSM_IMPORT: {
                struct hsm_user_import *hui;