[LU-10767] Potential buffer overflow in lfs_setdirstripe

• Type: Bug
• Resolution: Not a Bug
• Priority: Minor
• Affects Version/s: Lustre 2.11.0
• Severity: 3
• Assignee: WC Triage
• Reporter: Oleg Drokin

Description

When we have more than 4000 MDTs, the code in lfs_setdirstripe will break:

                        if (auto_distributed) {
                                int r;
                                int nr = MAX(param->lsp_stripe_count,
                                             lsb->sb_count / 2);

                                /* don't use server whose usage is above 90% */
                                while (nr != param->lsp_stripe_count &&
                                       obd_statfs_ratio(&lsb->sb_buf[nr].sd_st)
                                       > 90)
                                        nr = MAX(param->lsp_stripe_count,
                                                 nr / 2);

                                /* get \a r between [0, nr) */
                                r = rand() % nr;

                                param->lsp_stripe_offset =
                                        lsb->sb_buf[r].sd_index;

but lsb->sb_buf is defined as 2000 elements (LL_STATFS_MAX->LOV_MAX_STRIPE_COUNT->2000)

This was introduced by https://review.whamcloud.com/30598

Issue Links

• is related to: LU-12624 DNE3: striped directory allocate stripes by QoS
• is related to: LU-10277 DNE3: allow 'lfs mkdir' to create directory on MDS which has more space