[LU-18998] Bufer over-read in lnet_fault_attr_to_attr4

• Type: Bug
• Resolution: Unresolved
• Priority: Minor
• Fix Version/s: Lustre 2.17.0
• Affects Version/s: Lustre 2.17.0
• Labels: smatch
• Severity: 3
• Assignee: WC Triage
• Reporter: Oleg Drokin

Description

Smatch highlights this issue in lnet_fault_attr_to_attr4():

 __builtin_memcpy() '&attr->u' too small (16 vs 64)

 static void
lnet_fault_attr_to_attr4(struct lnet_fault_large_attr *attr,
                         struct lnet_fault_attr *attr4)
{
        if (!attr)
                return;
        attr4->fa_src = lnet_nid_to_nid4(&attr->fa_src);
        attr4->fa_dst = lnet_nid_to_nid4(&attr->fa_dst);
        attr4->fa_local_nid = lnet_nid_to_nid4(&attr->fa_local_nid);
        attr4->fa_ptl_mask = attr->fa_ptl_mask;
        attr4->fa_msg_mask = attr->fa_msg_mask;
        memcpy(&attr4->u, &attr->u, sizeof(attr4->u));
}

So I guess the idea is to take sizeof attr->u? ot otherwise make sure we are not reading or writing any more than we can.

Introduced in https://review.whamcloud.com/c/fs/lustre-release/+/53731

Issue Links

• is related to: LU-9680 Improve the user land to kernel space interface for lustre