Details
-
Bug
-
Resolution: Fixed
-
Minor
-
None
-
None
-
3
-
9223372036854775807
Description
lprocfs_mds_evict_client_seq_write/lprocfs_evict_client_seq_write use UUID_MAX to determine the number of bytes to copy from userspace, but large NIDs can exceed this size.
#define BUFLEN (UUID_MAX + 4) static ssize_t lprocfs_mds_evict_client_seq_write(struct file *file, const char __user *buf, size_t count, loff_t *off) { struct seq_file *m = file->private_data; struct obd_device *obd = m->private; struct mdt_device *mdt = mdt_dev(obd->obd_lu_dev); char *kbuf; char *tmpbuf; int rc = 0; OBD_ALLOC(kbuf, BUFLEN); if (kbuf == NULL) return -ENOMEM; /* * OBD_ALLOC() will zero kbuf, but we only copy BUFLEN - 1 * bytes into kbuf, to ensure that the string is NUL-terminated. * UUID_MAX should include a trailing NUL already. */ if (copy_from_user(kbuf, buf, min_t(unsigned long, BUFLEN - 1, count))) GOTO(out, rc = -EFAULT);
LNet NIDs can be up to LNET_NIDSTR_SIZE (64) bytes, so a large NID will get truncated, no matching export found, and thus no eviction.
Attachments
Issue Links
- is duplicated by
-
LU-18209 conf-sanity test 91: fails to evict large NIDs
- Closed