LU-4563 Fix unsafe userspace access in many proc files

[fs/lustre-release.git] / lustre / ofd / lproc_ofd.c

diff --git a/lustre/ofd/lproc_ofd.c b/lustre/ofd/lproc_ofd.c
index e303fd6..359b373 100644 (file)
--- a/lustre/ofd/lproc_ofd.c
+++ b/lustre/ofd/lproc_ofd.c
@@ -117,7 +117,8 @@ static int lprocfs_ofd_rd_grant_ratio(char *page, char **start, off_t off,
                        (int) ofd_grant_reserved(ofd, 100));
 }
 
-static int lprocfs_ofd_wr_grant_ratio(struct file *file, const char *buffer,
+static int lprocfs_ofd_wr_grant_ratio(struct file *file,
+                                     const char __user *buffer,
                                      unsigned long count, void *data)
 {
        struct obd_device       *obd = (struct obd_device *)data;
@@ -157,7 +158,8 @@ static int lprocfs_ofd_rd_precreate_batch(char *page, char **start, off_t off,
        return snprintf(page, count, "%d\n", ofd->ofd_precreate_batch);
 }
 
-static int lprocfs_ofd_wr_precreate_batch(struct file *file, const char *buffer,
+static int lprocfs_ofd_wr_precreate_batch(struct file *file,
+                                         const char __user *buffer,
                                          unsigned long count, void *data)
 {
        struct obd_device *obd = (struct obd_device *)data;
@@ -224,7 +226,7 @@ int lprocfs_ofd_rd_fmd_max_num(char *page, char **start, off_t off,
        return rc;
 }
 
-int lprocfs_ofd_wr_fmd_max_num(struct file *file, const char *buffer,
+int lprocfs_ofd_wr_fmd_max_num(struct file *file, const char __user *buffer,
                               unsigned long count, void *data)
 {
        struct obd_device       *obd = data;
@@ -254,7 +256,7 @@ int lprocfs_ofd_rd_fmd_max_age(char *page, char **start, off_t off,
        return rc;
 }
 
-int lprocfs_ofd_wr_fmd_max_age(struct file *file, const char *buffer,
+int lprocfs_ofd_wr_fmd_max_age(struct file *file, const char __user *buffer,
                               unsigned long count, void *data)
 {
        struct obd_device       *obd = data;
@@ -284,7 +286,7 @@ static int lprocfs_ofd_rd_capa(char *page, char **start, off_t off,
        return rc;
 }
 
-static int lprocfs_ofd_wr_capa(struct file *file, const char *buffer,
+static int lprocfs_ofd_wr_capa(struct file *file, const char __user *buffer,
                               unsigned long count, void *data)
 {
        struct obd_device       *obd = data;
@@ -324,7 +326,7 @@ int lprocfs_ofd_rd_degraded(char *page, char **start, off_t off,
        return snprintf(page, count, "%u\n", ofd->ofd_raid_degraded);
 }
 
-int lprocfs_ofd_wr_degraded(struct file *file, const char *buffer,
+int lprocfs_ofd_wr_degraded(struct file *file, const char __user *buffer,
                            unsigned long count, void *data)
 {
        struct obd_device       *obd = data;
@@ -366,7 +368,7 @@ int lprocfs_ofd_rd_syncjournal(char *page, char **start, off_t off,
        return rc;
 }
 
-int lprocfs_ofd_wr_syncjournal(struct file *file, const char *buffer,
+int lprocfs_ofd_wr_syncjournal(struct file *file, const char __user *buffer,
                               unsigned long count, void *data)
 {
        struct obd_device       *obd = data;
@@ -389,6 +391,8 @@ int lprocfs_ofd_wr_syncjournal(struct file *file, const char *buffer,
        return count;
 }
 
+/* This must be longer than the longest string below */
+#define SYNC_STATES_MAXLEN 16
 static char *sync_on_cancel_states[] = {"never",
                                        "blocking",
                                        "always" };
@@ -405,24 +409,39 @@ int lprocfs_ofd_rd_sync_lock_cancel(char *page, char **start, off_t off,
        return rc;
 }
 
-int lprocfs_ofd_wr_sync_lock_cancel(struct file *file, const char *buffer,
+int lprocfs_ofd_wr_sync_lock_cancel(struct file *file,
+                                   const char __user *buffer,
                                    unsigned long count, void *data)
 {
        struct obd_device       *obd = data;
        struct lu_target        *tgt = obd->u.obt.obt_lut;
+       char                     kernbuf[SYNC_STATES_MAXLEN];
        int                      val = -1;
        int                      i;
 
+       if (count == 0 || count >= sizeof(kernbuf))
+               return -EINVAL;
+
+       if (copy_from_user(kernbuf, buffer, count))
+               return -EFAULT;
+       kernbuf[count] = 0;
+
+       if (kernbuf[count - 1] == '\n')
+               kernbuf[count - 1] = 0;
+
        for (i = 0 ; i < NUM_SYNC_ON_CANCEL_STATES; i++) {
-               if (memcmp(buffer, sync_on_cancel_states[i],
-                          strlen(sync_on_cancel_states[i])) == 0) {
+               if (strcmp(kernbuf, sync_on_cancel_states[i]) == 0) {
                        val = i;
                        break;
                }
        }
+
+       /* Legacy numeric codes */
        if (val == -1) {
                int rc;
 
+               /* Safe to use userspace buffer as lprocfs_write_helper will
+                * use copy from user for parsing */
                rc = lprocfs_write_helper(buffer, count, &val);
                if (rc)
                        return rc;
@@ -448,7 +467,8 @@ int lprocfs_ofd_rd_grant_compat_disable(char *page, char **start, off_t off,
        return rc;
 }
 
-int lprocfs_ofd_wr_grant_compat_disable(struct file *file, const char *buffer,
+int lprocfs_ofd_wr_grant_compat_disable(struct file *file,
+                                       const char __user *buffer,
                                        unsigned long count, void *data)
 {
        struct obd_device       *obd = data;
@@ -480,7 +500,7 @@ int lprocfs_ofd_rd_soft_sync_limit(char *page, char **start, off_t off,
                               &ofd->ofd_soft_sync_limit);
 }
 
-int lprocfs_ofd_wr_soft_sync_limit(struct file *file, const char *buffer,
+int lprocfs_ofd_wr_soft_sync_limit(struct file *file, const char __user *buffer,
                                   unsigned long count, void *data)
 {
        struct obd_device       *obd = data;
@@ -500,7 +520,8 @@ static int lprocfs_rd_lfsck_speed_limit(char *page, char **start, off_t off,
        return lfsck_get_speed(ofd->ofd_osd, page, count);
 }
 
-static int lprocfs_wr_lfsck_speed_limit(struct file *file, const char *buffer,
+static int lprocfs_wr_lfsck_speed_limit(struct file *file,
+                                       const char __user *buffer,
                                        unsigned long count, void *data)
 {
        struct obd_device       *obd = data;
@@ -528,6 +549,39 @@ static int lprocfs_rd_lfsck_layout(char *page, char **start, off_t off,
        return lfsck_dump(ofd->ofd_osd, page, count, LT_LAYOUT);
 }
 
+static int lprocfs_rd_lfsck_verify_pfid(char *page, char **start, off_t off,
+                                       int count, int *eof, void *data)
+{
+       struct obd_device       *obd = data;
+       struct ofd_device       *ofd = ofd_dev(obd->obd_lu_dev);
+
+       *eof = 1;
+
+       return snprintf(page, count,
+                       "switch: %s\ndetected: "LPU64"\nrepaired: "LPU64"\n",
+                       ofd->ofd_lfsck_verify_pfid ? "on" : "off",
+                       ofd->ofd_inconsistency_self_detected,
+                       ofd->ofd_inconsistency_self_repaired);
+}
+
+static int lprocfs_wr_lfsck_verify_pfid(struct file *file,
+                                       const char __user *buffer,
+                                       unsigned long count, void *data)
+{
+       struct obd_device       *obd = data;
+       struct ofd_device       *ofd = ofd_dev(obd->obd_lu_dev);
+       __u32                    val;
+       int                      rc;
+
+       rc = lprocfs_write_helper(buffer, count, &val);
+       if (rc != 0)
+               return rc;
+
+       ofd->ofd_lfsck_verify_pfid = !!val;
+
+       return count;
+}
+
 static struct lprocfs_vars lprocfs_ofd_obd_vars[] = {
        { "uuid",                lprocfs_rd_uuid, 0, 0 },
        { "blocksize",           lprocfs_rd_blksize, 0, 0 },
@@ -580,6 +634,8 @@ static struct lprocfs_vars lprocfs_ofd_obd_vars[] = {
        { "lfsck_speed_limit",  lprocfs_rd_lfsck_speed_limit,
                                lprocfs_wr_lfsck_speed_limit, 0 },
        { "lfsck_layout",       lprocfs_rd_lfsck_layout, 0, 0 },
+       { "lfsck_verify_pfid",  lprocfs_rd_lfsck_verify_pfid,
+                               lprocfs_wr_lfsck_verify_pfid, 0 },
        { 0 }
 };