Whamcloud - gitweb
LU-4563 Fix unsafe userspace access in many proc files
[fs/lustre-release.git] / lustre / llite / lproc_llite.c
index 8c4a148..97cfc09 100644 (file)
 #include <obd_support.h>
 
 #include "llite_internal.h"
+#include "vvp_internal.h"
 
 struct proc_dir_entry *proc_lustre_fs_root;
 
 #ifdef LPROCFS
 /* /proc/lustre/llite mount point registration */
-extern struct file_operations vvp_dump_pgcache_file_ops;
 struct file_operations ll_rw_extents_stats_fops;
 struct file_operations ll_rw_extents_stats_pp_fops;
 struct file_operations ll_rw_offset_stats_fops;
@@ -385,14 +385,14 @@ static int ll_max_cached_mb_seq_show(struct seq_file *m, void *v)
        int unused_mb;
 
        max_cached_mb = cache->ccc_lru_max >> shift;
-       unused_mb = cfs_atomic_read(&cache->ccc_lru_left) >> shift;
+       unused_mb = atomic_read(&cache->ccc_lru_left) >> shift;
        return seq_printf(m,
                        "users: %d\n"
                        "max_cached_mb: %d\n"
                        "used_mb: %d\n"
                        "unused_mb: %d\n"
                        "reclaim_count: %u\n",
-                       cfs_atomic_read(&cache->ccc_users),
+                       atomic_read(&cache->ccc_users),
                        max_cached_mb,
                        max_cached_mb - unused_mb,
                        unused_mb,
@@ -400,7 +400,7 @@ static int ll_max_cached_mb_seq_show(struct seq_file *m, void *v)
 }
 
 static ssize_t
-ll_max_cached_mb_seq_write(struct file *file, const char *buffer,
+ll_max_cached_mb_seq_write(struct file *file, const char __user *buffer,
                           size_t count, loff_t *off)
 {
        struct seq_file *m = file->private_data;
@@ -412,10 +412,19 @@ ll_max_cached_mb_seq_write(struct file *file, const char *buffer,
        int mult, rc, pages_number;
        int diff = 0;
        int nrpages = 0;
+       char kernbuf[128];
        ENTRY;
 
+       if (count >= sizeof(kernbuf))
+               RETURN(-EINVAL);
+
+       if (copy_from_user(kernbuf, buffer, count))
+               RETURN(-EFAULT);
+       kernbuf[count] = 0;
+
        mult = 1 << (20 - PAGE_CACHE_SHIFT);
-       buffer = lprocfs_find_named_value(buffer, "max_cached_mb:", &count);
+       buffer += lprocfs_find_named_value(kernbuf, "max_cached_mb:", &count) -
+                 kernbuf;
        rc = lprocfs_write_frac_helper(buffer, count, &pages_number, mult);
        if (rc)
                RETURN(rc);
@@ -436,7 +445,7 @@ ll_max_cached_mb_seq_write(struct file *file, const char *buffer,
 
        /* easy - add more LRU slots. */
        if (diff >= 0) {
-               cfs_atomic_add(diff, &cache->ccc_lru_left);
+               atomic_add(diff, &cache->ccc_lru_left);
                GOTO(out, rc = 0);
        }
 
@@ -452,12 +461,12 @@ ll_max_cached_mb_seq_write(struct file *file, const char *buffer,
                do {
                        int ov, nv;
 
-                       ov = cfs_atomic_read(&cache->ccc_lru_left);
+                       ov = atomic_read(&cache->ccc_lru_left);
                        if (ov == 0)
                                break;
 
                        nv = ov > diff ? ov - diff : 0;
-                       rc = cfs_atomic_cmpxchg(&cache->ccc_lru_left, ov, nv);
+                       rc = atomic_cmpxchg(&cache->ccc_lru_left, ov, nv);
                        if (likely(ov == rc)) {
                                diff -= ov - nv;
                                nrpages += ov - nv;
@@ -486,7 +495,7 @@ out:
                spin_unlock(&sbi->ll_lock);
                rc = count;
        } else {
-               cfs_atomic_add(nrpages, &cache->ccc_lru_left);
+               atomic_add(nrpages, &cache->ccc_lru_left);
        }
        return rc;
 }
@@ -814,7 +823,7 @@ static int ll_unstable_stats_seq_show(struct seq_file *m, void *v)
        struct cl_client_cache  *cache = &sbi->ll_cache;
        int pages, mb;
 
-       pages = cfs_atomic_read(&cache->ccc_unstable_nr);
+       pages = atomic_read(&cache->ccc_unstable_nr);
        mb    = (pages * PAGE_CACHE_SIZE) >> 20;
 
        return seq_printf(m, "unstable_pages: %8d\n"
@@ -888,7 +897,7 @@ struct lprocfs_seq_vars lprocfs_llite_obd_vars[] = {
 
 #define MAX_STRING_SIZE 128
 
-struct llite_file_opcode {
+static const struct llite_file_opcode {
         __u32       opcode;
         __u32       type;
         const char *opname;
@@ -1216,24 +1225,39 @@ static int ll_rw_extents_stats_pp_seq_show(struct seq_file *seq, void *v)
 }
 
 static ssize_t ll_rw_extents_stats_pp_seq_write(struct file *file,
-                                                const char *buf, size_t len,
-                                                loff_t *off)
+                                               const char __user *buf,
+                                               size_t len,
+                                               loff_t *off)
 {
-        struct seq_file *seq = file->private_data;
-        struct ll_sb_info *sbi = seq->private;
-        struct ll_rw_extents_info *io_extents = &sbi->ll_rw_extents_info;
-        int i;
-        int value = 1, rc = 0;
+       struct seq_file *seq = file->private_data;
+       struct ll_sb_info *sbi = seq->private;
+       struct ll_rw_extents_info *io_extents = &sbi->ll_rw_extents_info;
+       int i;
+       int value = 1, rc = 0;
 
-        rc = lprocfs_write_helper(buf, len, &value);
-        if (rc < 0 && (strcmp(buf, "disabled") == 0 ||
-                       strcmp(buf, "Disabled") == 0))
-                value = 0;
+       if (len == 0)
+               return -EINVAL;
 
-        if (value == 0)
-                sbi->ll_rw_stats_on = 0;
-        else
-                sbi->ll_rw_stats_on = 1;
+       rc = lprocfs_write_helper(buf, len, &value);
+       if (rc < 0 && len < 16) {
+               char kernbuf[16];
+
+               if (copy_from_user(kernbuf, buf, len))
+                       return -EFAULT;
+               kernbuf[len] = 0;
+
+               if (kernbuf[len - 1] == '\n')
+                       kernbuf[len - 1] = 0;
+
+               if (strcmp(kernbuf, "disabled") == 0 ||
+                   strcmp(kernbuf, "Disabled") == 0)
+                       value = 0;
+       }
+
+       if (value == 0)
+               sbi->ll_rw_stats_on = 0;
+       else
+               sbi->ll_rw_stats_on = 1;
 
        spin_lock(&sbi->ll_pp_extent_lock);
        for (i = 0; i < LL_PROCESS_HIST_MAX; i++) {
@@ -1275,24 +1299,40 @@ static int ll_rw_extents_stats_seq_show(struct seq_file *seq, void *v)
        return 0;
 }
 
-static ssize_t ll_rw_extents_stats_seq_write(struct file *file, const char *buf,
-                                        size_t len, loff_t *off)
+static ssize_t ll_rw_extents_stats_seq_write(struct file *file,
+                                            const char __user *buf,
+                                            size_t len, loff_t *off)
 {
-        struct seq_file *seq = file->private_data;
-        struct ll_sb_info *sbi = seq->private;
-        struct ll_rw_extents_info *io_extents = &sbi->ll_rw_extents_info;
-        int i;
-        int value = 1, rc = 0;
+       struct seq_file *seq = file->private_data;
+       struct ll_sb_info *sbi = seq->private;
+       struct ll_rw_extents_info *io_extents = &sbi->ll_rw_extents_info;
+       int i;
+       int value = 1, rc = 0;
 
-        rc = lprocfs_write_helper(buf, len, &value);
-        if (rc < 0 && (strcmp(buf, "disabled") == 0 ||
-                       strcmp(buf, "Disabled") == 0))
-                value = 0;
+       if (len == 0)
+               return -EINVAL;
+
+       rc = lprocfs_write_helper(buf, len, &value);
+       if (rc < 0 && len < 16) {
+               char kernbuf[16];
+
+               if (copy_from_user(kernbuf, buf, len))
+                       return -EFAULT;
+               kernbuf[len] = 0;
+
+               if (kernbuf[len - 1] == '\n')
+                       kernbuf[len - 1] = 0;
+
+               if (strcmp(kernbuf, "disabled") == 0 ||
+                   strcmp(kernbuf, "Disabled") == 0)
+                       value = 0;
+       }
+
+       if (value == 0)
+               sbi->ll_rw_stats_on = 0;
+       else
+               sbi->ll_rw_stats_on = 1;
 
-        if (value == 0)
-                sbi->ll_rw_stats_on = 0;
-        else
-                sbi->ll_rw_stats_on = 1;
        spin_lock(&sbi->ll_pp_extent_lock);
        for (i = 0; i <= LL_PROCESS_HIST_MAX; i++) {
                io_extents->pp_extents[i].pid = 0;
@@ -1303,7 +1343,6 @@ static ssize_t ll_rw_extents_stats_seq_write(struct file *file, const char *buf,
 
        return len;
 }
-
 LPROC_SEQ_FOPS(ll_rw_extents_stats);
 
 void ll_rw_stats_tally(struct ll_sb_info *sbi, pid_t pid,
@@ -1465,25 +1504,40 @@ static int ll_rw_offset_stats_seq_show(struct seq_file *seq, void *v)
        return 0;
 }
 
-static ssize_t ll_rw_offset_stats_seq_write(struct file *file, const char *buf,
-                                       size_t len, loff_t *off)
+static ssize_t ll_rw_offset_stats_seq_write(struct file *file,
+                                           const char __user *buf,
+                                           size_t len, loff_t *off)
 {
-        struct seq_file *seq = file->private_data;
-        struct ll_sb_info *sbi = seq->private;
-        struct ll_rw_process_info *process_info = sbi->ll_rw_process_info;
-        struct ll_rw_process_info *offset_info = sbi->ll_rw_offset_info;
-        int value = 1, rc = 0;
+       struct seq_file *seq = file->private_data;
+       struct ll_sb_info *sbi = seq->private;
+       struct ll_rw_process_info *process_info = sbi->ll_rw_process_info;
+       struct ll_rw_process_info *offset_info = sbi->ll_rw_offset_info;
+       int value = 1, rc = 0;
 
-        rc = lprocfs_write_helper(buf, len, &value);
+       if (len == 0)
+               return -EINVAL;
 
-        if (rc < 0 && (strcmp(buf, "disabled") == 0 ||
-                           strcmp(buf, "Disabled") == 0))
-                value = 0;
+       rc = lprocfs_write_helper(buf, len, &value);
 
-        if (value == 0)
-                sbi->ll_rw_stats_on = 0;
-        else
-                sbi->ll_rw_stats_on = 1;
+       if (rc < 0 && len < 16) {
+               char kernbuf[16];
+
+               if (copy_from_user(kernbuf, buf, len))
+                       return -EFAULT;
+               kernbuf[len] = 0;
+
+               if (kernbuf[len - 1] == '\n')
+                       kernbuf[len - 1] = 0;
+
+               if (strcmp(kernbuf, "disabled") == 0 ||
+                   strcmp(kernbuf, "Disabled") == 0)
+                       value = 0;
+       }
+
+       if (value == 0)
+               sbi->ll_rw_stats_on = 0;
+       else
+               sbi->ll_rw_stats_on = 1;
 
        spin_lock(&sbi->ll_process_lock);
        sbi->ll_offset_process_count = 0;