LU-4563 Fix unsafe userspace access in many proc files

Also add a test to make sure no new ones are added in the future

Change-Id: I2fe7d2cea5daef21f4279ce813ca35f6d91f68dc
Signed-off-by: Oleg Drokin <oleg.drokin@intel.com>
Reviewed-on: http://review.whamcloud.com/9059
Tested-by: Jenkins
Reviewed-by: Dmitry Eremin <dmitry.eremin@intel.com>
Tested-by: Maloo <hpdd-maloo@intel.com>
Reviewed-by: James Simmons <uja.ornl@gmail.com>

diff --git a/lustre/fid/lproc_fid.c b/lustre/fid/lproc_fid.c
index 3b9d170..3f2cd68 100644 (file)
--- a/lustre/fid/lproc_fid.c
+++ b/lustre/fid/lproc_fid.c
@@ -53,6 +53,9 @@
 #include <md_object.h>
 
 #ifdef LPROCFS
+
+/* Format: [0x64BIT_INT - 0x64BIT_INT] + 32 bytes just in case */
+#define MAX_FID_RANGE_STRLEN (32 + 2 * 2 * sizeof(__u64))
 /**
  * Reduce the SEQ range allocated to a node to a strict subset of the range
  * currently-allocated SEQ range.  If the specified range is "clear", then
@@ -62,22 +65,31 @@
  * safe for production use.
  */
 static int
-lprocfs_fid_write_common(const char *buffer, unsigned long count,
+lprocfs_fid_write_common(const char __user *buffer, size_t count,
                                struct lu_seq_range *range)
 {
        struct lu_seq_range tmp = { 0, };
        int rc;
+       char kernbuf[MAX_FID_RANGE_STRLEN];
        ENTRY;
 
        LASSERT(range != NULL);
 
-       if (count == 5 && strcmp(buffer, "clear") == 0) {
+       if (count >= sizeof(kernbuf))
+               RETURN(-EINVAL);
+
+       if (copy_from_user(kernbuf, buffer, count))
+               RETURN(-EFAULT);
+
+       kernbuf[count] = 0;
+
+       if (count == 5 && strcmp(kernbuf, "clear") == 0) {
                memset(range, 0, sizeof(*range));
                RETURN(0);
        }
 
        /* of the form "[0x0000000240000400 - 0x000000028000400]" */
-       rc = sscanf(buffer, "[%llx - %llx]\n",
+       rc = sscanf(kernbuf, "[%llx - %llx]\n",
                    (long long unsigned *)&tmp.lsr_start,
                    (long long unsigned *)&tmp.lsr_end);
        if (!range_is_sane(&tmp) || range_is_zero(&tmp) ||
@@ -92,7 +104,7 @@ lprocfs_fid_write_common(const char *buffer, unsigned long count,
  * Server side procfs stuff.
  */
 static ssize_t
-lprocfs_server_fid_space_seq_write(struct file *file, const char *buffer,
+lprocfs_server_fid_space_seq_write(struct file *file, const char __user *buffer,
                                        size_t count, loff_t *off)
 {
        struct lu_server_seq *seq = ((struct seq_file *)file->private_data)->private;
@@ -155,7 +167,7 @@ lprocfs_server_fid_server_seq_show(struct seq_file *m, void *unused)
 }
 
 static ssize_t
-lprocfs_server_fid_width_seq_write(struct file *file, const char *buffer,
+lprocfs_server_fid_width_seq_write(struct file *file, const char __user *buffer,
                                        size_t count, loff_t *off)
 {
        struct lu_server_seq *seq = ((struct seq_file *)file->private_data)->private;
@@ -421,26 +433,27 @@ static int fldb_seq_release(struct inode *inode, struct file *file)
        return 0;
 }
 
-static ssize_t fldb_seq_write(struct file *file, const char *buf,
+static ssize_t fldb_seq_write(struct file *file, const char __user *buf,
                              size_t len, loff_t *off)
 {
        struct seq_file         *seq = file->private_data;
        struct fld_seq_param    *param;
        struct lu_seq_range      range;
        int                      rc = 0;
-       char                    *buffer, *_buffer;
+       char                     _buffer[MAX_FID_RANGE_STRLEN];
+       char                    *buffer = _buffer;
        ENTRY;
 
        param = seq->private;
        if (param == NULL)
                RETURN(-EINVAL);
 
-       OBD_ALLOC(buffer, len + 1);
-       if (buffer == NULL)
-               RETURN(-ENOMEM);
-       memcpy(buffer, buf, len);
+       if (len >= sizeof(_buffer))
+               RETURN(-EINVAL);
+
+       if (copy_from_user(buffer, buf, len))
+               GOTO(out, rc = -EFAULT);
        buffer[len] = 0;
-       _buffer = buffer;
 
        /*
         * format - [0x0000000200000007-0x0000000200000008):0:mdt
@@ -478,7 +491,6 @@ static ssize_t fldb_seq_write(struct file *file, const char *buf,
                                   &range, &param->fsp_env);
 
 out:
-       OBD_FREE(_buffer, len + 1);
        RETURN(rc < 0 ? rc : len);
 }
 
@@ -494,7 +506,7 @@ const struct file_operations seq_fld_proc_seq_fops = {
 
 /* Client side procfs stuff */
 static ssize_t
-lprocfs_client_fid_space_seq_write(struct file *file, const char *buffer,
+lprocfs_client_fid_space_seq_write(struct file *file, const char __user *buffer,
                                   size_t count, loff_t *off)
 {
        struct lu_client_seq *seq = ((struct seq_file *)file->private_data)->private;
@@ -533,7 +545,7 @@ lprocfs_client_fid_space_seq_show(struct seq_file *m, void *unused)
 }
 
 static ssize_t
-lprocfs_client_fid_width_seq_write(struct file *file, const char *buffer,
+lprocfs_client_fid_width_seq_write(struct file *file, const char __user *buffer,
                                   size_t count, loff_t *off)
 {
        struct lu_client_seq *seq = ((struct seq_file *)file->private_data)->private;

diff --git a/lustre/llite/lproc_llite.c b/lustre/llite/lproc_llite.c
index 9937cdf..97cfc09 100644 (file)
--- a/lustre/llite/lproc_llite.c
+++ b/lustre/llite/lproc_llite.c
@@ -400,7 +400,7 @@ static int ll_max_cached_mb_seq_show(struct seq_file *m, void *v)
 }
 
 static ssize_t
-ll_max_cached_mb_seq_write(struct file *file, const char *buffer,
+ll_max_cached_mb_seq_write(struct file *file, const char __user *buffer,
                           size_t count, loff_t *off)
 {
        struct seq_file *m = file->private_data;
@@ -412,10 +412,19 @@ ll_max_cached_mb_seq_write(struct file *file, const char *buffer,
        int mult, rc, pages_number;
        int diff = 0;
        int nrpages = 0;
+       char kernbuf[128];
        ENTRY;
 
+       if (count >= sizeof(kernbuf))
+               RETURN(-EINVAL);
+
+       if (copy_from_user(kernbuf, buffer, count))
+               RETURN(-EFAULT);
+       kernbuf[count] = 0;
+
        mult = 1 << (20 - PAGE_CACHE_SHIFT);
-       buffer = lprocfs_find_named_value(buffer, "max_cached_mb:", &count);
+       buffer += lprocfs_find_named_value(kernbuf, "max_cached_mb:", &count) -
+                 kernbuf;
        rc = lprocfs_write_frac_helper(buffer, count, &pages_number, mult);
        if (rc)
                RETURN(rc);
@@ -1216,24 +1225,39 @@ static int ll_rw_extents_stats_pp_seq_show(struct seq_file *seq, void *v)
 }
 
 static ssize_t ll_rw_extents_stats_pp_seq_write(struct file *file,
-                                                const char *buf, size_t len,
-                                                loff_t *off)
+                                               const char __user *buf,
+                                               size_t len,
+                                               loff_t *off)
 {
-        struct seq_file *seq = file->private_data;
-        struct ll_sb_info *sbi = seq->private;
-        struct ll_rw_extents_info *io_extents = &sbi->ll_rw_extents_info;
-        int i;
-        int value = 1, rc = 0;
+       struct seq_file *seq = file->private_data;
+       struct ll_sb_info *sbi = seq->private;
+       struct ll_rw_extents_info *io_extents = &sbi->ll_rw_extents_info;
+       int i;
+       int value = 1, rc = 0;
 
-        rc = lprocfs_write_helper(buf, len, &value);
-        if (rc < 0 && (strcmp(buf, "disabled") == 0 ||
-                       strcmp(buf, "Disabled") == 0))
-                value = 0;
+       if (len == 0)
+               return -EINVAL;
 
-        if (value == 0)
-                sbi->ll_rw_stats_on = 0;
-        else
-                sbi->ll_rw_stats_on = 1;
+       rc = lprocfs_write_helper(buf, len, &value);
+       if (rc < 0 && len < 16) {
+               char kernbuf[16];
+
+               if (copy_from_user(kernbuf, buf, len))
+                       return -EFAULT;
+               kernbuf[len] = 0;
+
+               if (kernbuf[len - 1] == '\n')
+                       kernbuf[len - 1] = 0;
+
+               if (strcmp(kernbuf, "disabled") == 0 ||
+                   strcmp(kernbuf, "Disabled") == 0)
+                       value = 0;
+       }
+
+       if (value == 0)
+               sbi->ll_rw_stats_on = 0;
+       else
+               sbi->ll_rw_stats_on = 1;
 
        spin_lock(&sbi->ll_pp_extent_lock);
        for (i = 0; i < LL_PROCESS_HIST_MAX; i++) {
@@ -1275,24 +1299,40 @@ static int ll_rw_extents_stats_seq_show(struct seq_file *seq, void *v)
        return 0;
 }
 
-static ssize_t ll_rw_extents_stats_seq_write(struct file *file, const char *buf,
-                                        size_t len, loff_t *off)
+static ssize_t ll_rw_extents_stats_seq_write(struct file *file,
+                                            const char __user *buf,
+                                            size_t len, loff_t *off)
 {
-        struct seq_file *seq = file->private_data;
-        struct ll_sb_info *sbi = seq->private;
-        struct ll_rw_extents_info *io_extents = &sbi->ll_rw_extents_info;
-        int i;
-        int value = 1, rc = 0;
+       struct seq_file *seq = file->private_data;
+       struct ll_sb_info *sbi = seq->private;
+       struct ll_rw_extents_info *io_extents = &sbi->ll_rw_extents_info;
+       int i;
+       int value = 1, rc = 0;
 
-        rc = lprocfs_write_helper(buf, len, &value);
-        if (rc < 0 && (strcmp(buf, "disabled") == 0 ||
-                       strcmp(buf, "Disabled") == 0))
-                value = 0;
+       if (len == 0)
+               return -EINVAL;
+
+       rc = lprocfs_write_helper(buf, len, &value);
+       if (rc < 0 && len < 16) {
+               char kernbuf[16];
+
+               if (copy_from_user(kernbuf, buf, len))
+                       return -EFAULT;
+               kernbuf[len] = 0;
+
+               if (kernbuf[len - 1] == '\n')
+                       kernbuf[len - 1] = 0;
+
+               if (strcmp(kernbuf, "disabled") == 0 ||
+                   strcmp(kernbuf, "Disabled") == 0)
+                       value = 0;
+       }
+
+       if (value == 0)
+               sbi->ll_rw_stats_on = 0;
+       else
+               sbi->ll_rw_stats_on = 1;
 
-        if (value == 0)
-                sbi->ll_rw_stats_on = 0;
-        else
-                sbi->ll_rw_stats_on = 1;
        spin_lock(&sbi->ll_pp_extent_lock);
        for (i = 0; i <= LL_PROCESS_HIST_MAX; i++) {
                io_extents->pp_extents[i].pid = 0;
@@ -1303,7 +1343,6 @@ static ssize_t ll_rw_extents_stats_seq_write(struct file *file, const char *buf,
 
        return len;
 }
-
 LPROC_SEQ_FOPS(ll_rw_extents_stats);
 
 void ll_rw_stats_tally(struct ll_sb_info *sbi, pid_t pid,
@@ -1465,25 +1504,40 @@ static int ll_rw_offset_stats_seq_show(struct seq_file *seq, void *v)
        return 0;
 }
 
-static ssize_t ll_rw_offset_stats_seq_write(struct file *file, const char *buf,
-                                       size_t len, loff_t *off)
+static ssize_t ll_rw_offset_stats_seq_write(struct file *file,
+                                           const char __user *buf,
+                                           size_t len, loff_t *off)
 {
-        struct seq_file *seq = file->private_data;
-        struct ll_sb_info *sbi = seq->private;
-        struct ll_rw_process_info *process_info = sbi->ll_rw_process_info;
-        struct ll_rw_process_info *offset_info = sbi->ll_rw_offset_info;
-        int value = 1, rc = 0;
+       struct seq_file *seq = file->private_data;
+       struct ll_sb_info *sbi = seq->private;
+       struct ll_rw_process_info *process_info = sbi->ll_rw_process_info;
+       struct ll_rw_process_info *offset_info = sbi->ll_rw_offset_info;
+       int value = 1, rc = 0;
 
-        rc = lprocfs_write_helper(buf, len, &value);
+       if (len == 0)
+               return -EINVAL;
 
-        if (rc < 0 && (strcmp(buf, "disabled") == 0 ||
-                           strcmp(buf, "Disabled") == 0))
-                value = 0;
+       rc = lprocfs_write_helper(buf, len, &value);
 
-        if (value == 0)
-                sbi->ll_rw_stats_on = 0;
-        else
-                sbi->ll_rw_stats_on = 1;
+       if (rc < 0 && len < 16) {
+               char kernbuf[16];
+
+               if (copy_from_user(kernbuf, buf, len))
+                       return -EFAULT;
+               kernbuf[len] = 0;
+
+               if (kernbuf[len - 1] == '\n')
+                       kernbuf[len - 1] = 0;
+
+               if (strcmp(kernbuf, "disabled") == 0 ||
+                   strcmp(kernbuf, "Disabled") == 0)
+                       value = 0;
+       }
+
+       if (value == 0)
+               sbi->ll_rw_stats_on = 0;
+       else
+               sbi->ll_rw_stats_on = 1;
 
        spin_lock(&sbi->ll_process_lock);
        sbi->ll_offset_process_count = 0;

diff --git a/lustre/mdt/mdt_coordinator.c b/lustre/mdt/mdt_coordinator.c
index a9ee560..651ed7a 100644 (file)
--- a/lustre/mdt/mdt_coordinator.c
+++ b/lustre/mdt/mdt_coordinator.c
@@ -1982,25 +1982,37 @@ GENERATE_PROC_METHOD(cdt_default_archive_id)
 #define CDT_DISABLE_CMD  "disabled"
 #define CDT_PURGE_CMD    "purge"
 #define CDT_HELP_CMD     "help"
+#define CDT_MAX_CMD_LEN  10
 
-int lprocfs_wr_hsm_cdt_control(struct file *file, const char *buffer,
+int lprocfs_wr_hsm_cdt_control(struct file *file, const char __user *buffer,
                               unsigned long count, void *data)
 {
        struct obd_device       *obd = data;
        struct mdt_device       *mdt = mdt_dev(obd->obd_lu_dev);
        struct coordinator      *cdt = &(mdt->mdt_coordinator);
        int                      rc, usage = 0;
+       char                     kernbuf[CDT_MAX_CMD_LEN];
        ENTRY;
 
+       if (count == 0 || count >= sizeof(kernbuf))
+               RETURN(-EINVAL);
+
+       if (copy_from_user(kernbuf, buffer, count))
+               RETURN(-EFAULT);
+       kernbuf[count] = 0;
+
+       if (kernbuf[count - 1] == '\n')
+               kernbuf[count - 1] = 0;
+
        rc = 0;
-       if (strncmp(buffer, CDT_ENABLE_CMD, strlen(CDT_ENABLE_CMD)) == 0) {
+       if (strcmp(kernbuf, CDT_ENABLE_CMD) == 0) {
                if (cdt->cdt_state == CDT_DISABLE) {
                        cdt->cdt_state = CDT_RUNNING;
                        mdt_hsm_cdt_wakeup(mdt);
                } else {
                        rc = mdt_hsm_cdt_start(mdt);
                }
-       } else if (strncmp(buffer, CDT_STOP_CMD, strlen(CDT_STOP_CMD)) == 0) {
+       } else if (strcmp(kernbuf, CDT_STOP_CMD) == 0) {
                if ((cdt->cdt_state == CDT_STOPPING) ||
                    (cdt->cdt_state == CDT_STOPPED)) {
                        CERROR("%s: Coordinator already stopped\n",
@@ -2009,8 +2021,7 @@ int lprocfs_wr_hsm_cdt_control(struct file *file, const char *buffer,
                } else {
                        cdt->cdt_state = CDT_STOPPING;
                }
-       } else if (strncmp(buffer, CDT_DISABLE_CMD,
-                          strlen(CDT_DISABLE_CMD)) == 0) {
+       } else if (strcmp(kernbuf, CDT_DISABLE_CMD) == 0) {
                if ((cdt->cdt_state == CDT_STOPPING) ||
                    (cdt->cdt_state == CDT_STOPPED)) {
                        CERROR("%s: Coordinator is stopped\n",
@@ -2019,9 +2030,9 @@ int lprocfs_wr_hsm_cdt_control(struct file *file, const char *buffer,
                } else {
                        cdt->cdt_state = CDT_DISABLE;
                }
-       } else if (strncmp(buffer, CDT_PURGE_CMD, strlen(CDT_PURGE_CMD)) == 0) {
+       } else if (strcmp(kernbuf, CDT_PURGE_CMD) == 0) {
                rc = hsm_cancel_all_actions(mdt);
-       } else if (strncmp(buffer, CDT_HELP_CMD, strlen(CDT_HELP_CMD)) == 0) {
+       } else if (strcmp(kernbuf, CDT_HELP_CMD) == 0) {
                usage = 1;
        } else {
                usage = 1;

diff --git a/lustre/mdt/mdt_lproc.c b/lustre/mdt/mdt_lproc.c
index 0ee5148..2603c79 100644 (file)
--- a/lustre/mdt/mdt_lproc.c
+++ b/lustre/mdt/mdt_lproc.c
@@ -287,8 +287,9 @@ static int lprocfs_rd_identity_expire(char *page, char **start, off_t off,
                         mdt->mdt_identity_cache->uc_entry_expire);
 }
 
-static int lprocfs_wr_identity_expire(struct file *file, const char *buffer,
-                                      unsigned long count, void *data)
+static int lprocfs_wr_identity_expire(struct file *file,
+                                     const char __user *buffer,
+                                     unsigned long count, void *data)
 {
         struct obd_device *obd = data;
         struct mdt_device *mdt = mdt_dev(obd->obd_lu_dev);
@@ -315,9 +316,9 @@ static int lprocfs_rd_identity_acquire_expire(char *page, char **start,
 }
 
 static int lprocfs_wr_identity_acquire_expire(struct file *file,
-                                              const char *buffer,
-                                              unsigned long count,
-                                              void *data)
+                                             const char __user *buffer,
+                                             unsigned long count,
+                                             void *data)
 {
         struct obd_device *obd = data;
         struct mdt_device *mdt = mdt_dev(obd->obd_lu_dev);
@@ -346,7 +347,8 @@ static int lprocfs_rd_identity_upcall(char *page, char **start, off_t off,
        return len;
 }
 
-static int lprocfs_wr_identity_upcall(struct file *file, const char *buffer,
+static int lprocfs_wr_identity_upcall(struct file *file,
+                                     const char __user *buffer,
                                      unsigned long count, void *data)
 {
        struct obd_device       *obd = data;
@@ -389,8 +391,9 @@ static int lprocfs_wr_identity_upcall(struct file *file, const char *buffer,
        RETURN(rc);
 }
 
-static int lprocfs_wr_identity_flush(struct file *file, const char *buffer,
-                                     unsigned long count, void *data)
+static int lprocfs_wr_identity_flush(struct file *file,
+                                    const char __user *buffer,
+                                    unsigned long count, void *data)
 {
         struct obd_device *obd = data;
         struct mdt_device *mdt = mdt_dev(obd->obd_lu_dev);
@@ -404,7 +407,8 @@ static int lprocfs_wr_identity_flush(struct file *file, const char *buffer,
         return count;
 }
 
-static int lprocfs_wr_identity_info(struct file *file, const char *buffer,
+static int lprocfs_wr_identity_info(struct file *file,
+                                   const char __user *buffer,
                                    unsigned long count, void *data)
 {
        struct obd_device *obd = data;
@@ -481,7 +485,7 @@ static int lprocfs_rd_capa(char *page, char **start, off_t off,
                        mdt->mdt_lut.lut_mds_capa ? "mds" : "");
 }
 
-static int lprocfs_wr_capa(struct file *file, const char *buffer,
+static int lprocfs_wr_capa(struct file *file, const char __user *buffer,
                           unsigned long count, void *data)
 {
        struct obd_device *obd = data;
@@ -548,8 +552,8 @@ static int lprocfs_rd_capa_timeout(char *page, char **start, off_t off,
         return snprintf(page, count, "%lu\n", mdt->mdt_capa_timeout);
 }
 
-static int lprocfs_wr_capa_timeout(struct file *file, const char *buffer,
-                                   unsigned long count, void *data)
+static int lprocfs_wr_capa_timeout(struct file *file, const char __user *buffer,
+                                  unsigned long count, void *data)
 {
         struct obd_device *obd = data;
         struct mdt_device *mdt = mdt_dev(obd->obd_lu_dev);
@@ -573,8 +577,8 @@ static int lprocfs_rd_ck_timeout(char *page, char **start, off_t off, int count,
         return snprintf(page, count, "%lu\n", mdt->mdt_ck_timeout);
 }
 
-static int lprocfs_wr_ck_timeout(struct file *file, const char *buffer,
-                                 unsigned long count, void *data)
+static int lprocfs_wr_ck_timeout(struct file *file, const char __user *buffer,
+                                unsigned long count, void *data)
 {
         struct obd_device *obd = data;
         struct mdt_device *mdt = mdt_dev(obd->obd_lu_dev);
@@ -591,8 +595,9 @@ static int lprocfs_wr_ck_timeout(struct file *file, const char *buffer,
 
 #define BUFLEN (UUID_MAX + 4)
 
-static int lprocfs_mdt_wr_evict_client(struct file *file, const char *buffer,
-                                       unsigned long count, void *data)
+static int lprocfs_mdt_wr_evict_client(struct file *file,
+                                      const char __user *buffer,
+                                      unsigned long count, void *data)
 {
         char *kbuf;
         char *tmpbuf;
@@ -636,8 +641,8 @@ static int lprocfs_rd_sec_level(char *page, char **start, off_t off,
        return snprintf(page, count, "%d\n", mdt->mdt_lut.lut_sec_level);
 }
 
-static int lprocfs_wr_sec_level(struct file *file, const char *buffer,
-                                unsigned long count, void *data)
+static int lprocfs_wr_sec_level(struct file *file, const char __user *buffer,
+                               unsigned long count, void *data)
 {
         struct obd_device *obd = data;
         struct mdt_device *mdt = mdt_dev(obd->obd_lu_dev);
@@ -669,8 +674,8 @@ static int lprocfs_rd_cos(char *page, char **start, off_t off,
         return snprintf(page, count, "%u\n", mdt_cos_is_enabled(mdt));
 }
 
-static int lprocfs_wr_cos(struct file *file, const char *buffer,
-                                  unsigned long count, void *data)
+static int lprocfs_wr_cos(struct file *file, const char __user *buffer,
+                         unsigned long count, void *data)
 {
         struct obd_device *obd = data;
         struct mdt_device *mdt = mdt_dev(obd->obd_lu_dev);
@@ -708,29 +713,29 @@ static int safe_strtoul(const char *str, char **endp, unsigned long *res)
         return 0;
 }
 
-static int lprocfs_wr_root_squash(struct file *file, const char *buffer,
+static int lprocfs_wr_root_squash(struct file *file, const char __user *buffer,
                                  unsigned long count, void *data)
 {
        struct obd_device *obd = data;
        struct mdt_device *mdt = mdt_dev(obd->obd_lu_dev);
        int rc;
-       char kernbuf[50], *tmp, *end, *errmsg;
+       char kernbuf[64], *tmp, *end, *errmsg;
        unsigned long uid, gid;
        int nouid, nogid;
        ENTRY;
 
        if (count >= sizeof(kernbuf)) {
                errmsg = "string too long";
-               GOTO(failed, rc = -EINVAL);
+               GOTO(failed_noprint, rc = -EINVAL);
        }
        if (copy_from_user(kernbuf, buffer, count)) {
                errmsg = "bad address";
-               GOTO(failed, rc = -EFAULT);
+               GOTO(failed_noprint, rc = -EFAULT);
        }
        kernbuf[count] = '\0';
 
        nouid = nogid = 0;
-       if (safe_strtoul(buffer, &tmp, &uid)) {
+       if (safe_strtoul(kernbuf, &tmp, &uid)) {
                uid = mdt->mdt_squash_uid;
                nouid = 1;
        }
@@ -762,7 +767,11 @@ static int lprocfs_wr_root_squash(struct file *file, const char *buffer,
 
 failed:
        CWARN("%s: failed to set root_squash to \"%s\", %s: rc %d\n",
-             mdt_obd_name(mdt), buffer, errmsg, rc);
+             mdt_obd_name(mdt), kernbuf, errmsg, rc);
+       RETURN(rc);
+failed_noprint:
+       CWARN("%s: failed to set root_squash due to %s: rc %d\n",
+             mdt_obd_name(mdt), errmsg, rc);
        RETURN(rc);
 }
 
@@ -777,7 +786,8 @@ static int lprocfs_rd_nosquash_nids(char *page, char **start, off_t off,
         return snprintf(page, count, "NONE\n");
 }
 
-static int lprocfs_wr_nosquash_nids(struct file *file, const char *buffer,
+static int lprocfs_wr_nosquash_nids(struct file *file,
+                                   const char __user *buffer,
                                    unsigned long count, void *data)
 {
        struct obd_device *obd = data;
@@ -853,8 +863,8 @@ static int lprocfs_rd_mdt_som(char *page, char **start, off_t off,
                         mdt->mdt_som_conf ? "en" : "dis");
 }
 
-static int lprocfs_wr_mdt_som(struct file *file, const char *buffer,
-                              unsigned long count, void *data)
+static int lprocfs_wr_mdt_som(struct file *file, const char __user *buffer,
+                             unsigned long count, void *data)
 {
         struct obd_export *exp;
         struct obd_device *obd = data;
@@ -912,7 +922,8 @@ static int lprocfs_rd_enable_remote_dir(char *page, char **start, off_t off,
        return snprintf(page, count, "%u\n", mdt->mdt_enable_remote_dir);
 }
 
-static int lprocfs_wr_enable_remote_dir(struct file *file, const char *buffer,
+static int lprocfs_wr_enable_remote_dir(struct file *file,
+                                       const char __user *buffer,
                                        unsigned long count, void *data)
 {
        struct obd_device *obd = data;
@@ -942,7 +953,7 @@ static int lprocfs_rd_enable_remote_dir_gid(char *page, char **start, off_t off,
 }
 
 static int lprocfs_wr_enable_remote_dir_gid(struct file *file,
-                                           const char *buffer,
+                                           const char __user *buffer,
                                            unsigned long count, void *data)
 {
        struct obd_device *obd = data;

diff --git a/lustre/mgs/mgs_internal.h b/lustre/mgs/mgs_internal.h
index d3baacd..457fbbb 100644 (file)
--- a/lustre/mgs/mgs_internal.h
+++ b/lustre/mgs/mgs_internal.h
@@ -227,7 +227,7 @@ void mgs_ir_fini_fs(struct mgs_device *mgs, struct fs_db *fsdb);
 void mgs_ir_notify_complete(struct fs_db *fsdb);
 int  mgs_get_ir_logs(struct ptlrpc_request *req);
 int  lprocfs_wr_ir_state(struct file *file, const char *buffer,
-                           unsigned long count, void *data);
+                        size_t count, void *data);
 int  lprocfs_rd_ir_state(struct seq_file *seq, void *data);
 ssize_t
 lprocfs_ir_timeout_seq_write(struct file *file, const char *buffer,

diff --git a/lustre/mgs/mgs_nids.c b/lustre/mgs/mgs_nids.c
index a4d8800..abeff63 100644 (file)
--- a/lustre/mgs/mgs_nids.c
+++ b/lustre/mgs/mgs_nids.c
@@ -748,25 +748,25 @@ static struct lproc_ir_cmd {
         { "0",        1, lprocfs_ir_clear_stats }
 };
 
-int lprocfs_wr_ir_state(struct file *file, const char *buffer,
-                         unsigned long count, void *data)
+int lprocfs_wr_ir_state(struct file *file, const char __user *buffer,
+                       size_t count, void *data)
 {
         struct fs_db *fsdb = data;
         char *kbuf;
         char *ptr;
         int rc = 0;
 
-       if (count > PAGE_CACHE_SIZE)
-                return -EINVAL;
+       if (count == 0 || count >= PAGE_CACHE_SIZE)
+               return -EINVAL;
 
-        OBD_ALLOC(kbuf, count + 1);
-        if (kbuf == NULL)
-                return -ENOMEM;
+       OBD_ALLOC(kbuf, count + 1);
+       if (kbuf == NULL)
+               return -ENOMEM;
 
-        if (copy_from_user(kbuf, buffer, count)) {
-                OBD_FREE(kbuf, count);
-                return -EFAULT;
-        }
+       if (copy_from_user(kbuf, buffer, count)) {
+               OBD_FREE(kbuf, count + 1);
+               return -EFAULT;
+       }
 
         kbuf[count] = 0; /* buffer is supposed to end with 0 */
         if (kbuf[count - 1] == '\n')
@@ -843,9 +843,9 @@ int lprocfs_ir_timeout_seq_show(struct seq_file *m, void *data)
        return lprocfs_uint_seq_show(m, &ir_timeout);
 }
 
-ssize_t
-lprocfs_ir_timeout_seq_write(struct file *file, const char *buffer,
-                            size_t count, loff_t *off)
+ssize_t lprocfs_ir_timeout_seq_write(struct file *file,
+                                    const char __user *buffer,
+                                    size_t count, loff_t *off)
 {
         return lprocfs_wr_uint(file, buffer, count, &ir_timeout);
 }

diff --git a/lustre/obdclass/linux/linux-module.c b/lustre/obdclass/linux/linux-module.c
index e96802d..1642123 100644 (file)
--- a/lustre/obdclass/linux/linux-module.c
+++ b/lustre/obdclass/linux/linux-module.c
@@ -300,15 +300,22 @@ static int obd_proc_jobid_var_seq_show(struct seq_file *m, void *v)
 }
 
 static ssize_t
-obd_proc_jobid_var_seq_write(struct file *file, const char *buffer,
-                               size_t count, loff_t *off)
+obd_proc_jobid_var_seq_write(struct file *file, const char __user *buffer,
+                            size_t count, loff_t *off)
 {
        if (!count || count > JOBSTATS_JOBID_VAR_MAX_LEN)
                return -EINVAL;
 
        memset(obd_jobid_var, 0, JOBSTATS_JOBID_VAR_MAX_LEN + 1);
+
+       /* This might leave the var invalid on error, which is probably fine.*/
+       if (copy_from_user(obd_jobid_var, buffer, count))
+               return -EFAULT;
+
        /* Trim the trailing '\n' if any */
-       memcpy(obd_jobid_var, buffer, count - (buffer[count - 1] == '\n'));
+       if (obd_jobid_var[count - 1] == '\n')
+               obd_jobid_var[count - 1] = 0;
+
        return count;
 }
 LPROC_SEQ_FOPS(obd_proc_jobid_var);

diff --git a/lustre/obdclass/lprocfs_jobstats.c b/lustre/obdclass/lprocfs_jobstats.c
index d443841..87a1303 100644 (file)
--- a/lustre/obdclass/lprocfs_jobstats.c
+++ b/lustre/obdclass/lprocfs_jobstats.c
@@ -430,7 +430,8 @@ static int lprocfs_jobstats_seq_open(struct inode *inode, struct file *file)
        return 0;
 }
 
-static ssize_t lprocfs_jobstats_seq_write(struct file *file, const char *buf,
+static ssize_t lprocfs_jobstats_seq_write(struct file *file,
+                                         const char __user *buf,
                                          size_t len, loff_t *off)
 {
        struct seq_file *seq = file->private_data;
@@ -439,18 +440,19 @@ static ssize_t lprocfs_jobstats_seq_write(struct file *file, const char *buf,
        int all = 0;
        struct job_stat *job;
 
-       if (!memcmp(buf, "clear", strlen("clear"))) {
-               all = 1;
-       } else if (len < JOBSTATS_JOBID_SIZE) {
-               memset(jobid, 0, JOBSTATS_JOBID_SIZE);
-               /* Trim '\n' if any */
-               if (buf[len - 1] == '\n')
-                       memcpy(jobid, buf, len - 1);
-               else
-                       memcpy(jobid, buf, len);
-       } else {
+       if (len == 0 || len >= JOBSTATS_JOBID_SIZE)
                return -EINVAL;
-       }
+
+       if (copy_from_user(jobid, buf, len))
+               return -EFAULT;
+       jobid[len] = 0;
+
+       /* Trim '\n' if any */
+       if (jobid[len - 1] == '\n')
+               jobid[len - 1] = 0;
+
+       if (strcmp(jobid, "clear") == 0)
+               all = 1;
 
        LASSERT(stats->ojs_hash);
        if (all) {
@@ -544,7 +546,7 @@ int lprocfs_rd_job_interval(char *page, char **start, off_t off,
 }
 EXPORT_SYMBOL(lprocfs_rd_job_interval);
 
-int lprocfs_wr_job_interval(struct file *file, const char *buffer,
+int lprocfs_wr_job_interval(struct file *file, const char __user *buffer,
                            unsigned long count, void *data)
 {
        struct obd_device *obd = (struct obd_device *)data;

diff --git a/lustre/obdclass/lprocfs_status.c b/lustre/obdclass/lprocfs_status.c
index 30d9f59..8b8effa 100644 (file)
--- a/lustre/obdclass/lprocfs_status.c
+++ b/lustre/obdclass/lprocfs_status.c
@@ -307,7 +307,7 @@ int lprocfs_evict_client_release(struct inode *inode, struct file *f)
 #define BUFLEN (UUID_MAX + 5)
 
 #ifndef HAVE_ONLY_PROCFS_SEQ
-int lprocfs_wr_evict_client(struct file *file, const char *buffer,
+int lprocfs_wr_evict_client(struct file *file, const char __user *buffer,
                            unsigned long count, void *data)
 {
        struct obd_device *obd = data;

diff --git a/lustre/ofd/lproc_ofd.c b/lustre/ofd/lproc_ofd.c
index 000d4ae..359b373 100644 (file)
--- a/lustre/ofd/lproc_ofd.c
+++ b/lustre/ofd/lproc_ofd.c
@@ -117,7 +117,8 @@ static int lprocfs_ofd_rd_grant_ratio(char *page, char **start, off_t off,
                        (int) ofd_grant_reserved(ofd, 100));
 }
 
-static int lprocfs_ofd_wr_grant_ratio(struct file *file, const char *buffer,
+static int lprocfs_ofd_wr_grant_ratio(struct file *file,
+                                     const char __user *buffer,
                                      unsigned long count, void *data)
 {
        struct obd_device       *obd = (struct obd_device *)data;
@@ -157,7 +158,8 @@ static int lprocfs_ofd_rd_precreate_batch(char *page, char **start, off_t off,
        return snprintf(page, count, "%d\n", ofd->ofd_precreate_batch);
 }
 
-static int lprocfs_ofd_wr_precreate_batch(struct file *file, const char *buffer,
+static int lprocfs_ofd_wr_precreate_batch(struct file *file,
+                                         const char __user *buffer,
                                          unsigned long count, void *data)
 {
        struct obd_device *obd = (struct obd_device *)data;
@@ -224,7 +226,7 @@ int lprocfs_ofd_rd_fmd_max_num(char *page, char **start, off_t off,
        return rc;
 }
 
-int lprocfs_ofd_wr_fmd_max_num(struct file *file, const char *buffer,
+int lprocfs_ofd_wr_fmd_max_num(struct file *file, const char __user *buffer,
                               unsigned long count, void *data)
 {
        struct obd_device       *obd = data;
@@ -254,7 +256,7 @@ int lprocfs_ofd_rd_fmd_max_age(char *page, char **start, off_t off,
        return rc;
 }
 
-int lprocfs_ofd_wr_fmd_max_age(struct file *file, const char *buffer,
+int lprocfs_ofd_wr_fmd_max_age(struct file *file, const char __user *buffer,
                               unsigned long count, void *data)
 {
        struct obd_device       *obd = data;
@@ -284,7 +286,7 @@ static int lprocfs_ofd_rd_capa(char *page, char **start, off_t off,
        return rc;
 }
 
-static int lprocfs_ofd_wr_capa(struct file *file, const char *buffer,
+static int lprocfs_ofd_wr_capa(struct file *file, const char __user *buffer,
                               unsigned long count, void *data)
 {
        struct obd_device       *obd = data;
@@ -324,7 +326,7 @@ int lprocfs_ofd_rd_degraded(char *page, char **start, off_t off,
        return snprintf(page, count, "%u\n", ofd->ofd_raid_degraded);
 }
 
-int lprocfs_ofd_wr_degraded(struct file *file, const char *buffer,
+int lprocfs_ofd_wr_degraded(struct file *file, const char __user *buffer,
                            unsigned long count, void *data)
 {
        struct obd_device       *obd = data;
@@ -366,7 +368,7 @@ int lprocfs_ofd_rd_syncjournal(char *page, char **start, off_t off,
        return rc;
 }
 
-int lprocfs_ofd_wr_syncjournal(struct file *file, const char *buffer,
+int lprocfs_ofd_wr_syncjournal(struct file *file, const char __user *buffer,
                               unsigned long count, void *data)
 {
        struct obd_device       *obd = data;
@@ -389,6 +391,8 @@ int lprocfs_ofd_wr_syncjournal(struct file *file, const char *buffer,
        return count;
 }
 
+/* This must be longer than the longest string below */
+#define SYNC_STATES_MAXLEN 16
 static char *sync_on_cancel_states[] = {"never",
                                        "blocking",
                                        "always" };
@@ -405,24 +409,39 @@ int lprocfs_ofd_rd_sync_lock_cancel(char *page, char **start, off_t off,
        return rc;
 }
 
-int lprocfs_ofd_wr_sync_lock_cancel(struct file *file, const char *buffer,
+int lprocfs_ofd_wr_sync_lock_cancel(struct file *file,
+                                   const char __user *buffer,
                                    unsigned long count, void *data)
 {
        struct obd_device       *obd = data;
        struct lu_target        *tgt = obd->u.obt.obt_lut;
+       char                     kernbuf[SYNC_STATES_MAXLEN];
        int                      val = -1;
        int                      i;
 
+       if (count == 0 || count >= sizeof(kernbuf))
+               return -EINVAL;
+
+       if (copy_from_user(kernbuf, buffer, count))
+               return -EFAULT;
+       kernbuf[count] = 0;
+
+       if (kernbuf[count - 1] == '\n')
+               kernbuf[count - 1] = 0;
+
        for (i = 0 ; i < NUM_SYNC_ON_CANCEL_STATES; i++) {
-               if (memcmp(buffer, sync_on_cancel_states[i],
-                          strlen(sync_on_cancel_states[i])) == 0) {
+               if (strcmp(kernbuf, sync_on_cancel_states[i]) == 0) {
                        val = i;
                        break;
                }
        }
+
+       /* Legacy numeric codes */
        if (val == -1) {
                int rc;
 
+               /* Safe to use userspace buffer as lprocfs_write_helper will
+                * use copy from user for parsing */
                rc = lprocfs_write_helper(buffer, count, &val);
                if (rc)
                        return rc;
@@ -448,7 +467,8 @@ int lprocfs_ofd_rd_grant_compat_disable(char *page, char **start, off_t off,
        return rc;
 }
 
-int lprocfs_ofd_wr_grant_compat_disable(struct file *file, const char *buffer,
+int lprocfs_ofd_wr_grant_compat_disable(struct file *file,
+                                       const char __user *buffer,
                                        unsigned long count, void *data)
 {
        struct obd_device       *obd = data;
@@ -480,7 +500,7 @@ int lprocfs_ofd_rd_soft_sync_limit(char *page, char **start, off_t off,
                               &ofd->ofd_soft_sync_limit);
 }
 
-int lprocfs_ofd_wr_soft_sync_limit(struct file *file, const char *buffer,
+int lprocfs_ofd_wr_soft_sync_limit(struct file *file, const char __user *buffer,
                                   unsigned long count, void *data)
 {
        struct obd_device       *obd = data;
@@ -500,7 +520,8 @@ static int lprocfs_rd_lfsck_speed_limit(char *page, char **start, off_t off,
        return lfsck_get_speed(ofd->ofd_osd, page, count);
 }
 
-static int lprocfs_wr_lfsck_speed_limit(struct file *file, const char *buffer,
+static int lprocfs_wr_lfsck_speed_limit(struct file *file,
+                                       const char __user *buffer,
                                        unsigned long count, void *data)
 {
        struct obd_device       *obd = data;
@@ -543,7 +564,8 @@ static int lprocfs_rd_lfsck_verify_pfid(char *page, char **start, off_t off,
                        ofd->ofd_inconsistency_self_repaired);
 }
 
-static int lprocfs_wr_lfsck_verify_pfid(struct file *file, const char *buffer,
+static int lprocfs_wr_lfsck_verify_pfid(struct file *file,
+                                       const char __user *buffer,
                                        unsigned long count, void *data)
 {
        struct obd_device       *obd = data;

diff --git a/lustre/osc/lproc_osc.c b/lustre/osc/lproc_osc.c
index ccfc212..2f8da8c 100644 (file)
--- a/lustre/osc/lproc_osc.c
+++ b/lustre/osc/lproc_osc.c
@@ -178,15 +178,24 @@ static int osc_cached_mb_seq_show(struct seq_file *m, void *v)
 
 /* shrink the number of caching pages to a specific number */
 static ssize_t
-osc_cached_mb_seq_write(struct file *file, const char *buffer,
+osc_cached_mb_seq_write(struct file *file, const char __user *buffer,
                        size_t count, loff_t *off)
 {
        struct obd_device *dev = ((struct seq_file *)file->private_data)->private;
        struct client_obd *cli = &dev->u.cli;
        int pages_number, mult, rc;
+       char kernbuf[128];
+
+       if (count >= sizeof(kernbuf))
+               return -EINVAL;
+
+       if (copy_from_user(kernbuf, buffer, count))
+               return -EFAULT;
+       kernbuf[count] = 0;
 
        mult = 1 << (20 - PAGE_CACHE_SHIFT);
-       buffer = lprocfs_find_named_value(buffer, "used_mb:", &count);
+       buffer += lprocfs_find_named_value(kernbuf, "used_mb:", &count) -
+                 kernbuf;
        rc = lprocfs_write_frac_helper(buffer, count, &pages_number, mult);
        if (rc)
                return rc;

diff --git a/lustre/osd-zfs/osd_lproc.c b/lustre/osd-zfs/osd_lproc.c
index 0854ce6..bc8a807 100644 (file)
--- a/lustre/osd-zfs/osd_lproc.c
+++ b/lustre/osd-zfs/osd_lproc.c
@@ -140,8 +140,8 @@ static int lprocfs_osd_wr_force_sync(struct file *file, const char *buffer,
        return rc == 0 ? count : rc;
 }
 
-static int lprocfs_osd_rd_iused_est(char *page, char **start, off_t off, int count,
-                                       int *eof, void *data)
+static int lprocfs_osd_rd_iused_est(char *page, char **start, off_t off,
+                                   int count, int *eof, void *data)
 {
        struct osd_device *osd = osd_dt_dev((struct dt_device *)data);
        LASSERT(osd != NULL);
@@ -149,8 +149,9 @@ static int lprocfs_osd_rd_iused_est(char *page, char **start, off_t off, int cou
        return snprintf(page, count, "%d\n", osd->od_quota_iused_est);
 }
 
-static int lprocfs_osd_wr_iused_est(struct file *file, const char *buffer,
-                                       unsigned long count, void *data)
+static int lprocfs_osd_wr_iused_est(struct file *file,
+                                   const char __user *buffer,
+                                   unsigned long count, void *data)
 {
        struct osd_device *osd = osd_dt_dev((struct dt_device *)data);
        int                rc, val;

diff --git a/lustre/tests/Makefile.am b/lustre/tests/Makefile.am
index 8d1833e..d0e657c 100644 (file)
--- a/lustre/tests/Makefile.am
+++ b/lustre/tests/Makefile.am
@@ -72,7 +72,7 @@ noinst_PROGRAMS += ll_sparseness_write mrename ll_dirstripe_verify mkdirmany
 noinst_PROGRAMS += openfilleddirunlink rename_many memhog
 noinst_PROGRAMS += mmap_sanity writemany reads flocks_test flock_deadlock
 noinst_PROGRAMS += write_time_limit rwv lgetxattr_size_check checkfiemap
-noinst_PROGRAMS += listxattr_size_check check_fhandle_syscalls
+noinst_PROGRAMS += listxattr_size_check check_fhandle_syscalls badarea_io
 
 bin_PROGRAMS = mcreate munlink
 testdir = $(libdir)/lustre/tests

diff --git a/lustre/tests/badarea_io.c b/lustre/tests/badarea_io.c
new file mode 100644 (file)
index 0000000..b926ce9
--- /dev/null
+++ b/lustre/tests/badarea_io.c
@@ -0,0 +1,59 @@
+#include <stdio.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <unistd.h>
+
+int main(int argc, char **argv)
+{
+       int rc;
+       int fd = open(argv[1], O_WRONLY);
+
+       if (fd == -1) {
+               perror(argv[1]);
+               goto read;
+       }
+
+       /* We need rc because Sles11 compiler warns against unchecked
+        * return value of read and write */
+       rc = write(fd, (void *)0x4096000, 5);
+       if (rc != 5)
+               perror("write badarea (Should have failed)");
+
+       rc = write(fd, &fd, 0);
+       if (rc != 0)
+               perror("write zero bytes");
+
+       rc = write(fd, &fd, 1);
+       if (rc != 1)
+               perror("write one byte");
+
+       rc = write(fd, &fd, 2UL*1024*1024);
+       if (rc != 2UL*1024*1024)
+               perror("write 2M");
+
+       rc = write(fd, &fd, 2UL*1024*1024*1024);
+       if (rc != 2UL*1024*1024*1024)
+               perror("write 2G");
+
+       rc = write(fd, &fd, -2);
+       if (rc != -2)
+               perror("write -2");
+
+       close(fd);
+
+read:
+       fd = open(argv[1], O_RDONLY);
+       if (fd == -1)
+               return 0;
+       rc = read(fd, (void *)0x4096000, 5);
+       perror("read");
+
+       close(fd);
+
+       /* Tame the compiler spooked about rc assigned, but not used */
+       if (!rc)
+               return -1; /* Not really important. */
+
+       return 0;
+}

diff --git a/lustre/tests/sanity.sh b/lustre/tests/sanity.sh
index ff1e5bb..d81cf53 100644 (file)
--- a/lustre/tests/sanity.sh
+++ b/lustre/tests/sanity.sh
@@ -8960,6 +8960,36 @@ test_133f() {
 }
 run_test 133f "Check for LBUGs/Oopses/unreadable files in /proc"
 
+test_133g() {
+       local proc_dirs="/proc/fs/lustre/ /proc/sys/lnet/ /proc/sys/lustre/"
+       local facet
+
+       # Second verifying readability.
+       find $proc_dirs \
+               -type f \
+               -not -name force_lbug \
+               -not -name changelog_mask \
+               -exec badarea_io '{}' \; > /dev/null
+
+       [ $(lustre_version_code $SINGLEMDS) -le $(version_code 2.5.54) ] &&
+               skip "Too old lustre on MDS"
+
+       [ $(lustre_version_code ost1) -le $(version_code 2.5.54) ] &&
+               skip "Too old lustre on ost1"
+
+       for facet in $SINGLEMDS ost1; do
+               do_facet $facet find $proc_dirs \
+                       -type f \
+                       -not -name force_lbug \
+                       -not -name changelog_mask \
+                       -exec badarea_io '{}' \\\; &> /dev/null
+
+       done
+
+       true
+}
+run_test 133g "Check for Oopses on bad io area writes/reads in /proc"
+
 test_140() { #bug-17379
        [ $PARALLEL == "yes" ] && skip "skip parallel run" && return
         test_mkdir -p $DIR/$tdir || error "Creating dir $DIR/$tdir"