[LU-7624] fld_proc_hash_seq_write accesses userspace pointer directly

• Type: Bug
• Resolution: Fixed
• Priority: Critical
• Fix Version/s: Lustre 2.8.0
• Affects Version/s: Lustre 2.7.0, Lustre 2.5.3, Lustre 2.8.0
• Labels: easy
• Severity: 3
• Assignee: Bob Glossman (Inactive)
• Reporter: Oleg Drokin

Description

In lustre/fld/lproc_fld.c we have this gem:

static ssize_t
fld_proc_hash_seq_write(struct file *file, const char __user *buffer,
                        size_t count, loff_t *off)
{
...
                if (!strncmp(fld_hash[i].fh_name, buffer, count)) {
                        hash = &fld_hash[i];
                        break;
                }
...

This is a bug and we cannot really access user pointers directly. The value first must be copied to a kernel buffer.

This was introduced in 2006 by Yury, part of cmd3 bringup.

Issue Links

• is related to: LU-7623 Clean up lustre user/kernel pointer types.
• is related to: LU-6215 Sync Lustre external tree with lustre linux kernel client