[LU-10767] Potential buffer overflow in lfs_setdirstripe

Related — Sat, 29 Jan 2022 09:46:27 +0000

When we have more than 4000 MDTs, the code in lfs_setdirstripe will break:

                        if (auto_distributed) {
                                int r;
                                int nr = MAX(param->lsp_stripe_count,
                                             lsb->sb_count / 2);

                                /* don't use server whose usage is above 90% */
                                while (nr != param->lsp_stripe_count &&
                                       obd_statfs_ratio(&lsb->sb_buf[nr].sd_st)
                                       > 90)
                                        nr = MAX(param->lsp_stripe_count,
                                                 nr / 2);

                                /* get \a r between [0, nr) */
                                r = rand() % nr;

                                param->lsp_stripe_offset =
                                        lsb->sb_buf[r].sd_index;

but lsb->sb_buf is defined as 2000 elements (LL_STATFS_MAX->LOV_MAX_STRIPE_COUNT->2000)

This was introduced by https://review.whamcloud.com/30598

Whamcloud Community JIRA

[LU-10767] Potential buffer overflow in lfs_setdirstripe