LU-985 lprocfs: verify user buffer access

[fs/lustre-release.git] / lustre / ptlrpc / lproc_ptlrpc.c

diff --git a/lustre/ptlrpc/lproc_ptlrpc.c b/lustre/ptlrpc/lproc_ptlrpc.c
index 2b5cefb..4fd4403 100644 (file)
--- a/lustre/ptlrpc/lproc_ptlrpc.c
+++ b/lustre/ptlrpc/lproc_ptlrpc.c
@@ -744,12 +744,30 @@ void ptlrpc_lprocfs_unregister_obd(struct obd_device *obd)
 EXPORT_SYMBOL(ptlrpc_lprocfs_unregister_obd);
 
 
+#define BUFLEN (UUID_MAX + 5)
+
 int lprocfs_wr_evict_client(struct file *file, const char *buffer,
                             unsigned long count, void *data)
 {
         struct obd_device *obd = data;
-        char tmpbuf[sizeof(struct obd_uuid)];
+        char              *kbuf;
+        char              *tmpbuf;
+
+        OBD_ALLOC(kbuf, BUFLEN);
+        if (kbuf == NULL)
+                return -ENOMEM;
 
+        /*
+         * OBD_ALLOC() will zero kbuf, but we only copy BUFLEN - 1
+         * bytes into kbuf, to ensure that the string is NUL-terminated.
+         * UUID_MAX should include a trailing NUL already.
+         */
+        if (cfs_copy_from_user(kbuf, buffer,
+                               min_t(unsigned long, BUFLEN - 1, count))) {
+                count = -EFAULT;
+                goto out;
+        }
+        tmpbuf = cfs_firststr(kbuf, min_t(unsigned long, BUFLEN - 1, count));
         /* Kludge code(deadlock situation): the lprocfs lock has been held
          * since the client is evicted by writting client's
          * uuid/nid to procfs "evict_client" entry. However,
@@ -760,7 +778,6 @@ int lprocfs_wr_evict_client(struct file *file, const char *buffer,
         class_incref(obd, __FUNCTION__, cfs_current());
         LPROCFS_EXIT();
 
-        sscanf(buffer, "%40s", tmpbuf);
         if (strncmp(tmpbuf, "nid:", 4) == 0)
                 obd_export_evict_by_nid(obd, tmpbuf + 4);
         else if (strncmp(tmpbuf, "uuid:", 5) == 0)
@@ -771,10 +788,14 @@ int lprocfs_wr_evict_client(struct file *file, const char *buffer,
         LPROCFS_ENTRY();
         class_decref(obd, __FUNCTION__, cfs_current());
 
+out:
+        OBD_FREE(kbuf, BUFLEN);
         return count;
 }
 EXPORT_SYMBOL(lprocfs_wr_evict_client);
 
+#undef BUFLEN
+
 int lprocfs_wr_ping(struct file *file, const char *buffer,
                     unsigned long count, void *data)
 {