LU-6078 utils: fix copytool file bounds checking

[fs/lustre-release.git] / lustre / utils / lhsmtool_posix.c

diff --git a/lustre/utils/lhsmtool_posix.c b/lustre/utils/lhsmtool_posix.c
index 183d910..5a81e4f 100644 (file)
--- a/lustre/utils/lhsmtool_posix.c
+++ b/lustre/utils/lhsmtool_posix.c
@@ -23,6 +23,7 @@
  * (C) Copyright 2012 Commissariat a l'energie atomique et aux energies
  *     alternatives
  *
+ * Copyright (c) 2013, 2014, Intel Corporation.
  */
 /* HSM copytool program for POSIX filesystem-based HSM's.
  *
@@ -41,6 +42,7 @@
 #include <stdlib.h>
 #include <dirent.h>
 #include <errno.h>
+#include <getopt.h>
 #include <time.h>
 #include <utime.h>
 #include <sys/time.h>
@@ -541,6 +543,14 @@ static int ct_copy_data(struct hsm_copyaction_private *hcp, const char *src,
                return rc;
        }
 
+       if (hai->hai_extent.offset > (__u64)src_st.st_size) {
+               rc = -EINVAL;
+               CT_ERROR(rc, "Trying to start reading past end ("LPU64" > "
+                        "%jd) of '%s' source file", hai->hai_extent.offset,
+                        (intmax_t)src_st.st_size, src);
+               return rc;
+       }
+
        if (fstat(dst_fd, &dst_st) < 0) {
                rc = -errno;
                CT_ERROR(rc, "cannot stat '%s'", dst);
@@ -553,17 +563,9 @@ static int ct_copy_data(struct hsm_copyaction_private *hcp, const char *src,
                return rc;
        }
 
-       rc = lseek(src_fd, hai->hai_extent.offset, SEEK_SET);
-       if (rc < 0) {
-               rc = -errno;
-               CT_ERROR(rc,
-                        "cannot seek for read to "LPU64" (len %jd) in '%s'",
-                        hai->hai_extent.offset, (intmax_t)src_st.st_size, src);
-               return rc;
-       }
-
        /* Don't read beyond a given extent */
-       length = min(hai->hai_extent.length, src_st.st_size);
+       length = min(hai->hai_extent.length,
+                    src_st.st_size - hai->hai_extent.offset);
 
        start_time = last_bw_print = last_report_time = time(NULL);
 
@@ -1772,6 +1774,10 @@ static void handler(int signal)
         * does successfully unmount and the mount is actually gone, but the
         * mtab entry remains. So this just makes mtab happier. */
        llapi_hsm_copytool_unregister(&ctdata);
+
+       /* Also remove fifo upon signal as during normal/error exit */
+       if (opt.o_event_fifo != NULL)
+               llapi_hsm_unregister_event_fifo(opt.o_event_fifo);
        _exit(1);
 }