LU-4563 Fix unsafe userspace access in many proc files

[fs/lustre-release.git] / lustre / obdclass / lprocfs_status.c

diff --git a/lustre/obdclass/lprocfs_status.c b/lustre/obdclass/lprocfs_status.c
index 29604ff..8b8effa 100644 (file)
--- a/lustre/obdclass/lprocfs_status.c
+++ b/lustre/obdclass/lprocfs_status.c
@@ -307,7 +307,7 @@ int lprocfs_evict_client_release(struct inode *inode, struct file *f)
 #define BUFLEN (UUID_MAX + 5)
 
 #ifndef HAVE_ONLY_PROCFS_SEQ
-int lprocfs_wr_evict_client(struct file *file, const char *buffer,
+int lprocfs_wr_evict_client(struct file *file, const char __user *buffer,
                            unsigned long count, void *data)
 {
        struct obd_device *obd = data;
@@ -1936,7 +1936,6 @@ lprocfs_seq_obd_setup(struct obd_device *obd)
        int rc = 0;
 
        LASSERT(obd != NULL);
-       LASSERT(obd->obd_vars != NULL);
        LASSERT(obd->obd_magic == OBD_DEVICE_MAGIC);
        LASSERT(obd->obd_type->typ_procroot != NULL);
 
@@ -2848,7 +2847,13 @@ int lprocfs_exp_setup(struct obd_export *exp, lnet_nid_t *nid, int *newnid)
        /* Return -EALREADY here so that we know that the /proc
         * entry already has been created */
        if (old_stat != new_stat) {
-               nidstat_putref(old_stat);
+               spin_lock(&exp->exp_lock);
+               if (exp->exp_nid_stats) {
+                       LASSERT(exp->exp_nid_stats == old_stat);
+                       nidstat_putref(exp->exp_nid_stats);
+               }
+               exp->exp_nid_stats = old_stat;
+               spin_unlock(&exp->exp_lock);
                GOTO(destroy_new, rc = -EALREADY);
        }
         /* not found - create */