LU-4563 Fix unsafe userspace access in many proc files

[fs/lustre-release.git] / lustre / ofd / lproc_ofd.c

diff --git a/lustre/ofd/lproc_ofd.c b/lustre/ofd/lproc_ofd.c
index 000d4ae..359b373 100644 (file)
--- a/lustre/ofd/lproc_ofd.c
+++ b/lustre/ofd/lproc_ofd.c
@@ -117,7 +117,8 @@ static int lprocfs_ofd_rd_grant_ratio(char *page, char **start, off_t off,
                        (int) ofd_grant_reserved(ofd, 100));
 }
 
-static int lprocfs_ofd_wr_grant_ratio(struct file *file, const char *buffer,
+static int lprocfs_ofd_wr_grant_ratio(struct file *file,
+                                     const char __user *buffer,
                                      unsigned long count, void *data)
 {
        struct obd_device       *obd = (struct obd_device *)data;
@@ -157,7 +158,8 @@ static int lprocfs_ofd_rd_precreate_batch(char *page, char **start, off_t off,
        return snprintf(page, count, "%d\n", ofd->ofd_precreate_batch);
 }
 
-static int lprocfs_ofd_wr_precreate_batch(struct file *file, const char *buffer,
+static int lprocfs_ofd_wr_precreate_batch(struct file *file,
+                                         const char __user *buffer,
                                          unsigned long count, void *data)
 {
        struct obd_device *obd = (struct obd_device *)data;
@@ -224,7 +226,7 @@ int lprocfs_ofd_rd_fmd_max_num(char *page, char **start, off_t off,
        return rc;
 }
 
-int lprocfs_ofd_wr_fmd_max_num(struct file *file, const char *buffer,
+int lprocfs_ofd_wr_fmd_max_num(struct file *file, const char __user *buffer,
                               unsigned long count, void *data)
 {
        struct obd_device       *obd = data;
@@ -254,7 +256,7 @@ int lprocfs_ofd_rd_fmd_max_age(char *page, char **start, off_t off,
        return rc;
 }
 
-int lprocfs_ofd_wr_fmd_max_age(struct file *file, const char *buffer,
+int lprocfs_ofd_wr_fmd_max_age(struct file *file, const char __user *buffer,
                               unsigned long count, void *data)
 {
        struct obd_device       *obd = data;
@@ -284,7 +286,7 @@ static int lprocfs_ofd_rd_capa(char *page, char **start, off_t off,
        return rc;
 }
 
-static int lprocfs_ofd_wr_capa(struct file *file, const char *buffer,
+static int lprocfs_ofd_wr_capa(struct file *file, const char __user *buffer,
                               unsigned long count, void *data)
 {
        struct obd_device       *obd = data;
@@ -324,7 +326,7 @@ int lprocfs_ofd_rd_degraded(char *page, char **start, off_t off,
        return snprintf(page, count, "%u\n", ofd->ofd_raid_degraded);
 }
 
-int lprocfs_ofd_wr_degraded(struct file *file, const char *buffer,
+int lprocfs_ofd_wr_degraded(struct file *file, const char __user *buffer,
                            unsigned long count, void *data)
 {
        struct obd_device       *obd = data;
@@ -366,7 +368,7 @@ int lprocfs_ofd_rd_syncjournal(char *page, char **start, off_t off,
        return rc;
 }
 
-int lprocfs_ofd_wr_syncjournal(struct file *file, const char *buffer,
+int lprocfs_ofd_wr_syncjournal(struct file *file, const char __user *buffer,
                               unsigned long count, void *data)
 {
        struct obd_device       *obd = data;
@@ -389,6 +391,8 @@ int lprocfs_ofd_wr_syncjournal(struct file *file, const char *buffer,
        return count;
 }
 
+/* This must be longer than the longest string below */
+#define SYNC_STATES_MAXLEN 16
 static char *sync_on_cancel_states[] = {"never",
                                        "blocking",
                                        "always" };
@@ -405,24 +409,39 @@ int lprocfs_ofd_rd_sync_lock_cancel(char *page, char **start, off_t off,
        return rc;
 }
 
-int lprocfs_ofd_wr_sync_lock_cancel(struct file *file, const char *buffer,
+int lprocfs_ofd_wr_sync_lock_cancel(struct file *file,
+                                   const char __user *buffer,
                                    unsigned long count, void *data)
 {
        struct obd_device       *obd = data;
        struct lu_target        *tgt = obd->u.obt.obt_lut;
+       char                     kernbuf[SYNC_STATES_MAXLEN];
        int                      val = -1;
        int                      i;
 
+       if (count == 0 || count >= sizeof(kernbuf))
+               return -EINVAL;
+
+       if (copy_from_user(kernbuf, buffer, count))
+               return -EFAULT;
+       kernbuf[count] = 0;
+
+       if (kernbuf[count - 1] == '\n')
+               kernbuf[count - 1] = 0;
+
        for (i = 0 ; i < NUM_SYNC_ON_CANCEL_STATES; i++) {
-               if (memcmp(buffer, sync_on_cancel_states[i],
-                          strlen(sync_on_cancel_states[i])) == 0) {
+               if (strcmp(kernbuf, sync_on_cancel_states[i]) == 0) {
                        val = i;
                        break;
                }
        }
+
+       /* Legacy numeric codes */
        if (val == -1) {
                int rc;
 
+               /* Safe to use userspace buffer as lprocfs_write_helper will
+                * use copy from user for parsing */
                rc = lprocfs_write_helper(buffer, count, &val);
                if (rc)
                        return rc;
@@ -448,7 +467,8 @@ int lprocfs_ofd_rd_grant_compat_disable(char *page, char **start, off_t off,
        return rc;
 }
 
-int lprocfs_ofd_wr_grant_compat_disable(struct file *file, const char *buffer,
+int lprocfs_ofd_wr_grant_compat_disable(struct file *file,
+                                       const char __user *buffer,
                                        unsigned long count, void *data)
 {
        struct obd_device       *obd = data;
@@ -480,7 +500,7 @@ int lprocfs_ofd_rd_soft_sync_limit(char *page, char **start, off_t off,
                               &ofd->ofd_soft_sync_limit);
 }
 
-int lprocfs_ofd_wr_soft_sync_limit(struct file *file, const char *buffer,
+int lprocfs_ofd_wr_soft_sync_limit(struct file *file, const char __user *buffer,
                                   unsigned long count, void *data)
 {
        struct obd_device       *obd = data;
@@ -500,7 +520,8 @@ static int lprocfs_rd_lfsck_speed_limit(char *page, char **start, off_t off,
        return lfsck_get_speed(ofd->ofd_osd, page, count);
 }
 
-static int lprocfs_wr_lfsck_speed_limit(struct file *file, const char *buffer,
+static int lprocfs_wr_lfsck_speed_limit(struct file *file,
+                                       const char __user *buffer,
                                        unsigned long count, void *data)
 {
        struct obd_device       *obd = data;
@@ -543,7 +564,8 @@ static int lprocfs_rd_lfsck_verify_pfid(char *page, char **start, off_t off,
                        ofd->ofd_inconsistency_self_repaired);
 }
 
-static int lprocfs_wr_lfsck_verify_pfid(struct file *file, const char *buffer,
+static int lprocfs_wr_lfsck_verify_pfid(struct file *file,
+                                       const char __user *buffer,
                                        unsigned long count, void *data)
 {
        struct obd_device       *obd = data;