LU-4563 Fix unsafe userspace access in many proc files

[fs/lustre-release.git] / lustre / osc / lproc_osc.c

diff --git a/lustre/osc/lproc_osc.c b/lustre/osc/lproc_osc.c
index d6e3703..2f8da8c 100644 (file)
--- a/lustre/osc/lproc_osc.c
+++ b/lustre/osc/lproc_osc.c
@@ -178,15 +178,24 @@ static int osc_cached_mb_seq_show(struct seq_file *m, void *v)
 
 /* shrink the number of caching pages to a specific number */
 static ssize_t
-osc_cached_mb_seq_write(struct file *file, const char *buffer,
+osc_cached_mb_seq_write(struct file *file, const char __user *buffer,
                        size_t count, loff_t *off)
 {
        struct obd_device *dev = ((struct seq_file *)file->private_data)->private;
        struct client_obd *cli = &dev->u.cli;
        int pages_number, mult, rc;
+       char kernbuf[128];
+
+       if (count >= sizeof(kernbuf))
+               return -EINVAL;
+
+       if (copy_from_user(kernbuf, buffer, count))
+               return -EFAULT;
+       kernbuf[count] = 0;
 
        mult = 1 << (20 - PAGE_CACHE_SHIFT);
-       buffer = lprocfs_find_named_value(buffer, "used_mb:", &count);
+       buffer += lprocfs_find_named_value(kernbuf, "used_mb:", &count) -
+                 kernbuf;
        rc = lprocfs_write_frac_helper(buffer, count, &pages_number, mult);
        if (rc)
                return rc;
@@ -543,37 +552,69 @@ LPROC_SEQ_FOPS_RW_TYPE(osc, import);
 LPROC_SEQ_FOPS_RW_TYPE(osc, pinger_recov);
 
 struct lprocfs_seq_vars lprocfs_osc_obd_vars[] = {
-       { "uuid",               &osc_uuid_fops                  },
-       { "ping",               &osc_ping_fops,         0, 0222 },
-       { "connect_flags",      &osc_connect_flags_fops         },
-       { "blocksize",          &osc_blksize_fops               },
-       { "kbytestotal",        &osc_kbytestotal_fops           },
-       { "kbytesfree",         &osc_kbytesfree_fops            },
-       { "kbytesavail",        &osc_kbytesavail_fops           },
-       { "filestotal",         &osc_filestotal_fops            },
-       { "filesfree",          &osc_filesfree_fops             },
-       { "ost_server_uuid",    &osc_server_uuid_fops           },
-       { "ost_conn_uuid",      &osc_conn_uuid_fops             },
-       { "active",             &osc_active_fops                },
-       { "max_pages_per_rpc",  &osc_obd_max_pages_per_rpc_fops },
-       { "max_rpcs_in_flight", &osc_max_rpcs_in_flight_fops    },
-       { "destroys_in_flight", &osc_destroys_in_flight_fops    },
-       { "max_dirty_mb",       &osc_max_dirty_mb_fops          },
-       { "osc_cached_mb",      &osc_cached_mb_fops             },
-       { "cur_dirty_bytes",    &osc_cur_dirty_bytes_fops       },
-       { "cur_grant_bytes",    &osc_cur_grant_bytes_fops       },
-       { "cur_lost_grant_bytes",       &osc_cur_lost_grant_bytes_fops  },
-       { "grant_shrink_interval",      &osc_grant_shrink_interval_fops },
-       { "checksums",          &osc_checksum_fops              },
-       { "checksum_type",      &osc_checksum_type_fops         },
-       { "resend_count",       &osc_resend_count_fops          },
-       { "timeouts",           &osc_timeouts_fops              },
-       { "contention_seconds", &osc_contention_seconds_fops    },
-       { "lockless_truncate",  &osc_lockless_truncate_fops     },
-       { "import",             &osc_import_fops                },
-       { "state",              &osc_state_fops                 },
-       { "pinger_recov",       &osc_pinger_recov_fops          },
-       { "unstable_stats",     &osc_unstable_stats_fops        },
+       { .name =       "uuid",
+         .fops =       &osc_uuid_fops                  },
+       { .name =       "ping",
+         .fops =       &osc_ping_fops,
+         .proc_mode =  0222                            },
+       { .name =       "connect_flags",
+         .fops =       &osc_connect_flags_fops         },
+       { .name =       "blocksize",
+         .fops =       &osc_blksize_fops               },
+       { .name =       "kbytestotal",
+         .fops =       &osc_kbytestotal_fops           },
+       { .name =       "kbytesfree",
+         .fops =       &osc_kbytesfree_fops            },
+       { .name =       "kbytesavail",
+         .fops =       &osc_kbytesavail_fops           },
+       { .name =       "filestotal",
+         .fops =       &osc_filestotal_fops            },
+       { .name =       "filesfree",
+         .fops =       &osc_filesfree_fops             },
+       { .name =       "ost_server_uuid",
+         .fops =       &osc_server_uuid_fops           },
+       { .name =       "ost_conn_uuid",
+         .fops =       &osc_conn_uuid_fops             },
+       { .name =       "active",
+         .fops =       &osc_active_fops                },
+       { .name =       "max_pages_per_rpc",
+         .fops =       &osc_obd_max_pages_per_rpc_fops },
+       { .name =       "max_rpcs_in_flight",
+         .fops =       &osc_max_rpcs_in_flight_fops    },
+       { .name =       "destroys_in_flight",
+         .fops =       &osc_destroys_in_flight_fops    },
+       { .name =       "max_dirty_mb",
+         .fops =       &osc_max_dirty_mb_fops          },
+       { .name =       "osc_cached_mb",
+         .fops =       &osc_cached_mb_fops             },
+       { .name =       "cur_dirty_bytes",
+         .fops =       &osc_cur_dirty_bytes_fops       },
+       { .name =       "cur_grant_bytes",
+         .fops =       &osc_cur_grant_bytes_fops       },
+       { .name =       "cur_lost_grant_bytes",
+         .fops =       &osc_cur_lost_grant_bytes_fops  },
+       { .name =       "grant_shrink_interval",
+         .fops =       &osc_grant_shrink_interval_fops },
+       { .name =       "checksums",
+         .fops =       &osc_checksum_fops              },
+       { .name =       "checksum_type",
+         .fops =       &osc_checksum_type_fops         },
+       { .name =       "resend_count",
+         .fops =       &osc_resend_count_fops          },
+       { .name =       "timeouts",
+         .fops =       &osc_timeouts_fops              },
+       { .name =       "contention_seconds",
+         .fops =       &osc_contention_seconds_fops    },
+       { .name =       "lockless_truncate",
+         .fops =       &osc_lockless_truncate_fops     },
+       { .name =       "import",
+         .fops =       &osc_import_fops                },
+       { .name =       "state",
+         .fops =       &osc_state_fops                 },
+       { .name =       "pinger_recov",
+         .fops =       &osc_pinger_recov_fops          },
+       { .name =       "unstable_stats",
+         .fops =       &osc_unstable_stats_fops        },
        { 0 }
 };