[LU-4088] echo_copyout_lsm wrong copy size

• Status: Resolved
• Project: Lustre
• Fix Version/s: Lustre 2.6.0
• Type: Bug
• Priority: Minor
• Reporter: Oleg Drokin
• Assignee: WC Triage
• Resolution: Fixed
• Severity: 3

Description

Found by Thomas Meyer <[e-mail]> and submitted to mainline kernel:

Author: Thomas Meyer <[e-mail]>
Date:   Thu Sep 19 23:45:46 2013 +0200

    staging: lustre: Cocci spatch "noderef"
    
    sizeof when applied to a pointer typed expression gives the size of the
    pointer.
    Found by coccinelle spatch "misc/noderef.cocci"
    
    Signed-off-by: Thomas Meyer <[e-mail]>
    Signed-off-by: Greg Kroah-Hartman <[e-mail]>

diff --git a/drivers/staging/lustre/lustre/obdecho/echo_client.c b/drivers/stagi
index 2644edf..c8b4344 100644
--- a/drivers/staging/lustre/lustre/obdecho/echo_client.c
+++ b/drivers/staging/lustre/lustre/obdecho/echo_client.c
@@ -1387,7 +1387,7 @@ echo_copyout_lsm (struct lov_stripe_md *lsm, void *_ulsm, 
        if (nob > ulsm_nob)
                return (-EINVAL);
 
-       if (copy_to_user (ulsm, lsm, sizeof(ulsm)))
+       if (copy_to_user (ulsm, lsm, sizeof(*ulsm)))
                return (-EFAULT);

Comments

[Oleg Drokin]

patch in http://review.whamcloud.com/7922

[John Hammond]

There's probably another in the gss userspace code:

diff -u -p lustre/utils/gss/write_bytes.h /tmp/nothing/utils/gss/write_bytes.h
--- lustre/utils/gss/write_bytes.h
+++ /tmp/nothing/utils/gss/write_bytes.h
@@ -111,7 +111,6 @@ get_buffer(char **ptr, const char *end,
 static inline int
 xdr_get_u32(u_int32_t **ptr, const u_int32_t *end, u_int32_t *res)
 {
-       if (get_bytes((char **)ptr, (char *)end, res, sizeof(res)))
           return -1;
           *res = ntohl(*res);
           return 0;

[Oleg Drokin]

patch landed