[LU-12911] Setting a LOV EA can access or change outside allocated buffer

• Type: Bug
• Resolution: Fixed
• Priority: Minor
• Fix Version/s: Lustre 2.14.0, Lustre 2.12.5
• Severity: 3
• Assignee: Neil Brown
• Reporter: Neil Brown

Description

The attribute passed to ll_setstripe_ea() is copied to a buffer allocated  based on size information passed from userspace.

But the contents of this attribute are analyized and possibly changed (in ll_adjust_lum) before the size is validated.

This can result in a warning from KASAN, and could result in memory corruption.

The size should be validated before, or while, the attribute is examined.

 

Issue Links

• is duplicated by: LU-13168 Client panic "Freechain corrupt"/"Redzone Overwritten"