Commit 6b2eb32e authored by Nathaniel Clark's avatar Nathaniel Clark Committed by Greg Kroah-Hartman

staging/lustre/llite: check for integer overflow in hsm user request

Check to make sure total size of request does not overflow when
calculated.  Return -1 from hur_len() if it does overflow.
Signed-off-by: default avatarNathaniel Clark <nathaniel.l.clark@intel.com>
Reviewed-on: http://review.whamcloud.com/10615
Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-4984Reviewed-by: default avatarAndreas Dilger <andreas.dilger@intel.com>
Reviewed-by: default avatarJohn L. Hammond <john.hammond@intel.com>
Signed-off-by: default avatarOleg Drokin <oleg.drokin@intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent d41b7b74
......@@ -997,12 +997,25 @@ static inline void *hur_data(struct hsm_user_request *hur)
return &(hur->hur_user_item[hur->hur_request.hr_itemcount]);
}
/** Compute the current length of the provided hsm_user_request. */
static inline int hur_len(struct hsm_user_request *hur)
/**
* Compute the current length of the provided hsm_user_request. This returns -1
* instead of an errno because ssize_t is defined to be only [ -1, SSIZE_MAX ]
*
* return -1 on bounds check error.
*/
static inline ssize_t hur_len(struct hsm_user_request *hur)
{
return offsetof(struct hsm_user_request,
hur_user_item[hur->hur_request.hr_itemcount]) +
hur->hur_request.hr_data_len;
__u64 size;
/* can't overflow a __u64 since hr_itemcount is only __u32 */
size = offsetof(struct hsm_user_request, hur_user_item[0]) +
(__u64)hur->hur_request.hr_itemcount *
sizeof(hur->hur_user_item[0]) + hur->hur_request.hr_data_len;
if (size != (ssize_t)size)
return -1;
return size;
}
/****** HSM RPCs to copytool *****/
......
......@@ -1787,7 +1787,7 @@ static long ll_dir_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
return ll_fid2path(inode, (void *)arg);
case LL_IOC_HSM_REQUEST: {
struct hsm_user_request *hur;
int totalsize;
ssize_t totalsize;
OBD_ALLOC_PTR(hur);
if (hur == NULL)
......@@ -1802,6 +1802,8 @@ static long ll_dir_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
/* Compute the whole struct size */
totalsize = hur_len(hur);
OBD_FREE_PTR(hur);
if (totalsize < 0)
return -E2BIG;
/* Final size will be more than double totalsize */
if (totalsize >= MDS_MAXREQSIZE / 3)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment