Commit 22aadb91 authored by frank zago's avatar frank zago Committed by Greg Kroah-Hartman

staging: lustre: hsm: stack overrun in hai_dump_data_field

The function hai_dump_data_field will do a stack buffer
overrun when cat'ing /sys/fs/lustre/.../hsm/actions if an action has
some data in it.

hai_dump_data_field uses snprintf. But there is no check for
truncation, and the value returned by snprintf is used as-is.  The
coordinator code calls hai_dump_data_field with 12 bytes in the
buffer. The 6th byte of data is printed incompletely to make room for
the terminating NUL. However snprintf still returns 2, so when
hai_dump_data_field writes the final NUL, it does it outside the
reserved buffer, in the 13th byte of the buffer. This stack buffer
overrun hangs my VM.

Fix by checking that there is enough room for the next 2 characters
plus the NUL terminator. Don't print half bytes. Change the format to
02X instead of .2X, which makes more sense.
Signed-off-by: default avatarfrank zago <fzago@cray.com>
Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-8171
Reviewed-on: http://review.whamcloud.com/20338Reviewed-by: default avatarJohn L. Hammond <john.hammond@intel.com>
Reviewed-by: default avatarJean-Baptiste Riaux <riaux.jb@intel.com>
Reviewed-by: default avatarOleg Drokin <oleg.drokin@intel.com>
Signed-off-by: default avatarJames Simmons <jsimmons@infradead.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 30af99db
......@@ -1209,23 +1209,21 @@ struct hsm_action_item {
* \retval buffer
*/
static inline char *hai_dump_data_field(struct hsm_action_item *hai,
char *buffer, int len)
char *buffer, size_t len)
{
int i, sz, data_len;
int i, data_len;
char *ptr;
ptr = buffer;
sz = len;
data_len = hai->hai_len - sizeof(*hai);
for (i = 0 ; (i < data_len) && (sz > 0) ; i++) {
int cnt;
cnt = snprintf(ptr, sz, "%.2X",
(unsigned char)hai->hai_data[i]);
ptr += cnt;
sz -= cnt;
for (i = 0; (i < data_len) && (len > 2); i++) {
snprintf(ptr, 3, "%02X", (unsigned char)hai->hai_data[i]);
ptr += 2;
len -= 2;
}
*ptr = '\0';
return buffer;
}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment