LU-4563 Fix unsafe userspace access in many proc files

[fs/lustre-release.git] / lustre / mgs / mgs_nids.c

diff --git a/lustre/mgs/mgs_nids.c b/lustre/mgs/mgs_nids.c
index 24c9d22..abeff63 100644 (file)
--- a/lustre/mgs/mgs_nids.c
+++ b/lustre/mgs/mgs_nids.c
@@ -748,25 +748,25 @@ static struct lproc_ir_cmd {
         { "0",        1, lprocfs_ir_clear_stats }
 };
 
-int lprocfs_wr_ir_state(struct file *file, const char *buffer,
-                         unsigned long count, void *data)
+int lprocfs_wr_ir_state(struct file *file, const char __user *buffer,
+                       size_t count, void *data)
 {
         struct fs_db *fsdb = data;
         char *kbuf;
         char *ptr;
         int rc = 0;
 
-       if (count > PAGE_CACHE_SIZE)
-                return -EINVAL;
+       if (count == 0 || count >= PAGE_CACHE_SIZE)
+               return -EINVAL;
 
-        OBD_ALLOC(kbuf, count + 1);
-        if (kbuf == NULL)
-                return -ENOMEM;
+       OBD_ALLOC(kbuf, count + 1);
+       if (kbuf == NULL)
+               return -ENOMEM;
 
-        if (copy_from_user(kbuf, buffer, count)) {
-                OBD_FREE(kbuf, count);
-                return -EFAULT;
-        }
+       if (copy_from_user(kbuf, buffer, count)) {
+               OBD_FREE(kbuf, count + 1);
+               return -EFAULT;
+       }
 
         kbuf[count] = 0; /* buffer is supposed to end with 0 */
         if (kbuf[count - 1] == '\n')
@@ -838,15 +838,14 @@ int lprocfs_rd_ir_state(struct seq_file *seq, void *data)
         return 0;
 }
 
-int lprocfs_rd_ir_timeout(char *page, char **start, off_t off, int count,
-                          int *eof, void *data)
+int lprocfs_ir_timeout_seq_show(struct seq_file *m, void *data)
 {
-        *eof = 1;
-        return snprintf(page, count, "%d\n", ir_timeout);
+       return lprocfs_uint_seq_show(m, &ir_timeout);
 }
 
-int lprocfs_wr_ir_timeout(struct file *file, const char *buffer,
-                          unsigned long count, void *data)
+ssize_t lprocfs_ir_timeout_seq_write(struct file *file,
+                                    const char __user *buffer,
+                                    size_t count, loff_t *off)
 {
         return lprocfs_wr_uint(file, buffer, count, &ir_timeout);
 }