LU-4984 llite: check for integer overflow in hsm user request

Check to make sure total size of request does not overflow when
calculated.  Return -1 from hur_len() if it does overflow.

Signed-off-by: Nathaniel Clark <nathaniel.l.clark@intel.com>
Change-Id: I6a3ca50c53ff38dab4165f20dac6fa00eb888df2
Reviewed-on: http://review.whamcloud.com/10615
Tested-by: Jenkins
Reviewed-by: Andreas Dilger <andreas.dilger@intel.com>
Reviewed-by: John L. Hammond <john.hammond@intel.com>
Tested-by: Maloo <hpdd-maloo@intel.com>

diff --git a/lustre/include/lustre/lustre_user.h b/lustre/include/lustre/lustre_user.h
index e6f07c0..8b612a3 100644 (file)
--- a/lustre/include/lustre/lustre_user.h
+++ b/lustre/include/lustre/lustre_user.h
@@ -1049,12 +1049,25 @@ static inline void *hur_data(struct hsm_user_request *hur)
        return &(hur->hur_user_item[hur->hur_request.hr_itemcount]);
 }
 
-/** Compute the current length of the provided hsm_user_request. */
-static inline int hur_len(struct hsm_user_request *hur)
+/**
+ * Compute the current length of the provided hsm_user_request.  This returns -1
+ * instead of an errno because ssize_t is defined to be only [ -1, SSIZE_MAX ]
+ *
+ * return -1 on bounds check error.
+ */
+static inline ssize_t hur_len(struct hsm_user_request *hur)
 {
-       return offsetof(struct hsm_user_request, hur_user_item[0]) +
-               hur->hur_request.hr_itemcount * sizeof(hur->hur_user_item[0]) +
-               hur->hur_request.hr_data_len;
+       __u64   size;
+
+       /* can't overflow a __u64 since hr_itemcount is only __u32 */
+       size = offsetof(struct hsm_user_request, hur_user_item[0]) +
+               (__u64)hur->hur_request.hr_itemcount *
+               sizeof(hur->hur_user_item[0]) + hur->hur_request.hr_data_len;
+
+       if (size != (ssize_t)size)
+               return -1;
+
+       return size;
 }
 
 /****** HSM RPCs to copytool *****/

diff --git a/lustre/llite/dir.c b/lustre/llite/dir.c
index 519e2dc..cea0dd3 100644 (file)
--- a/lustre/llite/dir.c
+++ b/lustre/llite/dir.c
@@ -1654,7 +1654,7 @@ out_rmdir:
                RETURN(ll_fid2path(inode, (void *)arg));
        case LL_IOC_HSM_REQUEST: {
                struct hsm_user_request *hur;
-               int                      totalsize;
+               ssize_t                  totalsize;
 
                OBD_ALLOC_PTR(hur);
                if (hur == NULL)
@@ -1669,6 +1669,8 @@ out_rmdir:
                /* Compute the whole struct size */
                totalsize = hur_len(hur);
                OBD_FREE_PTR(hur);
+               if (totalsize < 0)
+                       RETURN(-E2BIG);
 
                /* Final size will be more than double totalsize */
                if (totalsize >= MDS_MAXREQSIZE / 3)

diff --git a/lustre/utils/lfs.c b/lustre/utils/lfs.c
index 57cac30..9c69498 100644 (file)
--- a/lustre/utils/lfs.c
+++ b/lustre/utils/lfs.c
@@ -3737,6 +3737,7 @@ static int lfs_hsm_request(int argc, char **argv, int action)
                        /* If allocated buffer was too small, gets something
                         * bigger */
                        if (nbfile_alloc <= hur->hur_request.hr_itemcount) {
+                               ssize_t size;
                                nbfile_alloc = nbfile_alloc * 2 + 1;
                                oldhur = hur;
                                hur = llapi_hsm_user_request_alloc(nbfile_alloc,
@@ -3750,7 +3751,16 @@ static int lfs_hsm_request(int argc, char **argv, int action)
                                        fclose(fp);
                                        goto out_free;
                                }
-                               memcpy(hur, oldhur, hur_len(oldhur));
+                               size = hur_len(oldhur);
+                               if (size < 0) {
+                                       fprintf(stderr, "Cannot allocate "
+                                               "the requested size\n");
+                                       hur = oldhur;
+                                       rc = -E2BIG;
+                                       fclose(fp);
+                                       goto out_free;
+                               }
+                               memcpy(hur, oldhur, size);
                                free(oldhur);
                        }