[LU-6395] One byte size shorter for name allocation in mgc_llog_local_copy() Created: 23/Mar/15  Updated: 14/Jun/18  Resolved: 27/Mar/15

Status: Resolved
Project: Lustre
Component/s: None
Affects Version/s: Lustre 2.8.0, Lustre 2.5.5
Fix Version/s: Lustre 2.8.0

Type: Bug Priority: Critical
Reporter: Di Wang Assignee: Di Wang
Resolution: Fixed Votes: 0
Labels: None

Issue Links:
Related
is related to LU-2059 mgc to backup configuration on osd-ba... Resolved
Severity: 3
Rank (Obsolete): 9223372036854775807

 Description   

In mgc_llog_local_copy, the temp_log name allocation is a byte shorter than it should be, which will cause bufer over-run in the following sprintf.

static int mgc_llog_local_copy(const struct lu_env *env,
                               struct obd_device *obd,
                               struct llog_ctxt *rctxt,
                               struct llog_ctxt *lctxt, char *logname)
{
        char    *temp_log;
        int      rc;

        ENTRY;

        /*
         * - copy it to backup using llog_backup()
         * - copy remote llog to logname using llog_backup()
         * - if failed then move bakup to logname again
         */

        OBD_ALLOC(temp_log, strlen(logname) + 1);
        if (!temp_log)
                RETURN(-ENOMEM);
        sprintf(temp_log, "%sT", logname);


 Comments   
Comment by Andreas Dilger [ 23/Mar/15 ]

Looks like this has been around since LU-2059 "llog: MGC to use OSD API for backup logs" patch http://review.whamcloud.com/5049 that was landed as v2_4_52_0-16-g3e38436. This may cause random memory corruption for logname % 4 == 3 or maybe logname % 8 == 7 when the trailing NUL overflows the allocated buffer.

Comment by Gerrit Updater [ 23/Mar/15 ]

wangdi (di.wang@intel.com) uploaded a new patch: http://review.whamcloud.com/14146
Subject: LU-6395 mgc: one byte shorter for logname allocation
Project: fs/lustre-release
Branch: master
Current Patch Set: 1
Commit: 6bbb35d29732c1f9bebce31a327503d945495ed0

Comment by Gerrit Updater [ 25/Mar/15 ]

Oleg Drokin (oleg.drokin@intel.com) merged in patch http://review.whamcloud.com/14146/
Subject: LU-6395 mgc: one byte shorter for logname allocation
Project: fs/lustre-release
Branch: master
Current Patch Set:
Commit: 0ffce067def1242e0f70fd6aeb8512a21f6bfa07

Comment by Peter Jones [ 27/Mar/15 ]

Landed for 2.8

Generated at Sat Feb 10 01:59:51 UTC 2024 using Jira 9.4.14#940014-sha1:734e6822bbf0d45eff9af51f82432957f73aa32c.