[LU-5476] Buffer overflow in ll_fid2path

• Status: Resolved
• Project: Lustre
• Affects Version/s: Lustre 2.5.0, Lustre 2.6.0, Lustre 2.4.2, Lustre 2.7.0
• Fix Version/s: Lustre 2.7.0
• Type: Bug
• Priority: Major
• Reporter: Oleg Drokin
• Assignee: WC Triage
• Resolution: Fixed
• Severity: 3

Description

Reported by Dan Carpenter against upstream client:

The patch d7e09d0397e8: "staging: add Lustre file system client
support" from May 2, 2013, leads to the following static checker
warning:

drivers/staging/lustre/lustre/llite/file.c:1730 ll_fid2path()
error: memcpy() 'gfout' too small

drivers/staging/lustre/lustre/llite/file.c
1719 if (copy_from_user(gfin, arg, sizeof(*gfin)))

{ 1720 OBD_FREE_PTR(gfin); 1721 return -EFAULT; 1722 }

1723
1724 outsize = sizeof(*gfout) + gfin->gf_pathlen;

outsize is an int.
gfin->gf_pathlen is a u32 which comes from the user.
The addition can overflow so outsize is less than sizeof(*gfout).

1725 OBD_ALLOC(gfout, outsize);
1726 if (gfout == NULL)

{ 1727 OBD_FREE_PTR(gfin); 1728 return -ENOMEM; 1729 }

1730 memcpy(gfout, gfin, sizeof(*gfout));

It would lead to memory corruption here. Probably we should add
something like:

if (gfin->gf_pathlen > PATH_MAX)
return -EINVAL;

Is that the right limit here?

1731 OBD_FREE_PTR(gfin);
1732
1733 /* Call mdc_iocontrol */
1734 rc = obd_iocontrol(OBD_IOC_FID2PATH, exp, outsize, gfout, NULL);

Comments

[Oleg Drokin]

Patch in http://review.whamcloud.com/11412

[Patrick Farrell (Inactive)]

Since you're looking at fid2path problems, could you possibly take a look at LU-4239?

http://review.whamcloud.com/10717

[Jodi Levi (Inactive)]

Patch landed to Master.