[LU-7624] fld_proc_hash_seq_write accesses userspace pointer directly

• Status: Resolved
• Project: Lustre
• Affects Version/s: Lustre 2.7.0, Lustre 2.5.3, Lustre 2.8.0
• Fix Version/s: Lustre 2.8.0
• Type: Bug
• Priority: Critical
• Reporter: Oleg Drokin
• Assignee: Bob Glossman (Inactive)
• Resolution: Fixed
• Labels: easy
• Severity: 3

Description

In lustre/fld/lproc_fld.c we have this gem:

static ssize_t
fld_proc_hash_seq_write(struct file *file, const char __user *buffer,
                        size_t count, loff_t *off)
{
...
                if (!strncmp(fld_hash[i].fh_name, buffer, count)) {
                        hash = &fld_hash[i];
                        break;
                }
...

This is a bug and we cannot really access user pointers directly. The value first must be copied to a kernel buffer.

This was introduced in 2006 by Yury, part of cmd3 bringup.

Issue Links

• is related to: LU-7623 Clean up lustre user/kernel pointer t...
• is related to: LU-6215 Sync Lustre external tree with lustre...

Comments

[Peter Jones]

Bob

Could you please fix this one?

Thanks

Peter

[Gerrit Updater]

Bob Glossman ([e-mail]) uploaded a new patch: http://review.whamcloud.com/17797
Subject: LU-7624 fld: copy userspace buffer
Project: fs/lustre-release
Branch: master
Current Patch Set: 1
Commit: 0ad4257e9873502971ce322f7590310e8cd42e33

[Gerrit Updater]

Oleg Drokin ([e-mail]) merged in patch http://review.whamcloud.com/17797/
Subject: LU-7624 fld: copy userspace buffer
Project: fs/lustre-release
Branch: master
Current Patch Set:
Commit: ab38c3afa2747c99b766b9bbdd825ef7593bc532

[James A Simmons]

Patch has landed. This ticket can be closed.

[Peter Jones]

Do you realize that you have permissions to mark tickets as resolved James?

[James A Simmons]

Oh I have been given power. How scary!!