[LU-7187] Client does not sanitize jobstats variable

• Type: Improvement
• Resolution: Fixed
• Priority: Critical
• Fix Version/s: Lustre 2.8.0
• Affects Version/s: Lustre 2.7.0, Lustre 2.5.4
• Environment: RHEL 6.6
• Assignee: Niu Yawei (Inactive)
• Reporter: Jesse Hanley

Description

The Lustre client doesn't appear to sanitize the contents of the job stats variable.

For example:
[root@client ~]# lctl set_param jobid_var=TESTINGVAR
jobid_var=TESTINGVAR

[user@client test_dir]# export TESTINGVAR=$(echo -e "test\n\n\a\b\tstring"); touch example.file

[user@mds1 ~]# lctl get_param -n mdt.*.job_stats
job_stats:

• job_id: test

string
snapshot_time: 1442594528
open:

{ samples: 1, unit: reqs }

close:

{ samples: 1, unit: reqs }

mknod:

{ samples: 0, unit: reqs }

link:

{ samples: 0, unit: reqs }

unlink:

{ samples: 0, unit: reqs }

mkdir:

{ samples: 0, unit: reqs }

rmdir:

{ samples: 0, unit: reqs }

rename:

{ samples: 0, unit: reqs }

getattr:

{ samples: 0, unit: reqs }

setattr:

{ samples: 1, unit: reqs }

getxattr:

{ samples: 0, unit: reqs }

setxattr:

{ samples: 0, unit: reqs }

statfs:

{ samples: 0, unit: reqs }

sync:

{ samples: 0, unit: reqs }

samedir_rename:

{ samples: 0, unit: reqs }

crossdir_rename:

{ samples: 0, unit: reqs }

This also produces an audible bell (the \a).

I wouldn't say this is a bug, but it is probably unintended behavior. It's definitely reproducible. I've tested with some various escape codes. Probably my favorite thus far has been setting color codes.

Thanks,
–
Jesse