Whamcloud Community JIRA

Whamcloud Community JIRA https://jira.whamcloud.com This file is an XML representation of an issue en-us

9.4.14

940014

05-12-2023

[LU-12811] lustre_swab_fiemap needs to check fm_mapped_extents https://jira.whamcloud.com/browse/LU-12811 Lustre <p>It looks like lustre_swab_fiemap can go beyond request buffer as it uses extent count number from network without any checking at face value</p> <p>similar problem exist at lustre_swab_lmv_mds_md_v1 for lmm1->lmv_stripe_count</p> <p>lustre_swab_object_update for ou->ou_params_count</p> LU-12811

lustre_swab_fiemap needs to check fm_mapped_extents

Bug Critical Resolved Fixed Emoly Liu Oleg Drokin LTS12 Fri, 27 Sep 2019 09:38:34 +0000 Fri, 22 May 2020 08:10:47 +0000 Fri, 15 May 2020 04:46:47 +0000 Lustre 2.13.0 Lustre 2.12.3 Lustre 2.14.0 0 5 <p><a href="https://jira.whamcloud.com/secure/ViewProfile.jspa?name=green" class="user-hover" rel="green">green</a> can this be considered a duplicate of <a href="https://jira.whamcloud.com/browse/LU-11997" title="Crash in lustre_swab_fiemap" class="issue-link" data-issue-key="LU-11997"><del>LU-11997</del></a>?</p> <p>no.</p> <p>The biggest obstacle to us doing the correct testing here is that we do not pass in the buffer size to swabbing functions. This is ok for fixed-size buffers, but once we start having variable-sized ones, we are in a bit of trouble.</p> <p>Naturally changing all swab functions to take a size argument will be a huge patch and is not necessary necessary.</p> <p>Now actually looking at the code, we do have variable arrays support denoted by RMF_F_STRUCT_ARRAY flag.</p> <p>So I wonder if we can actually make this work with a field that consists of a static header and then the array. Potentially we need to create a new field type to describe this and it would only be used where needed that way we don't need to update every swab function with the length argument.</p> <p>Emoly Liu (emoly@whamcloud.com) uploaded a new patch: <a href="https://review.whamcloud.com/36435" class="external-link" target="_blank" rel="nofollow noopener">https://review.whamcloud.com/36435</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-12811" title="lustre_swab_fiemap needs to check fm_mapped_extents" class="issue-link" data-issue-key="LU-12811"><del>LU-12811</del></a> ptlrpc: add some validation checks<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: 1<br/> Commit: a931b21beb6895c9b70b76bb5fc6a3cd069f3b5e</p> <p>One option for passing the length to the swabbing function without having to change all of the swabbers at once would be to add a separate <tt>rmf_swab_len</tt> function pointer to <tt>req_msg_field</tt>:</p> <div class="code panel" style="border-width: 1px;"><div class="codeContent panelContent"> <pre class="code-java"> <span class="code-object">int</span> (*rmf_swab_len)(void *, len); </pre> </div></div> <p>and assign this with a new <tt>DEFINE_MSGFL()</tt> macro, similar to <tt>DEFINE_MSGF()</tt>. </p> <p>Then, in <tt>swabber_dumper_helper()</tt> if the <tt>->rmf_swab_len()</tt> function is available, that should be used in preference to <tt>->rmf_swabber()</tt> and can pass the buffer length ("len" in that function) to <tt>lustre_swab_fiemap()</tt> (and the other similar functions) with an extra "u32 len" argument.</p> <p>That allows proper verification of the fields and avoids potential overflow. Unfortunately, there is no way to return an error from those functions (void functions all the way up), so the best we can do is limit the swabbing to the fields that fit within the buffer length and then return <tt>-EOVERFLOW</tt>. While the error itself will be ignored by the caller, we may as well make the new function prototype return the error as the starting point to fixing the rest of the code to handle errors better in the future.</p> <p>Also, the "<tt>LASSERT((len % field->rmf_size) == 0)</tt>" in <tt>swabber_dumper_helper()</tt> should be removed, but I'm not sure what to do in case of an error at that point, since there is the same inability to return an error to the caller and there are too many callers to <tt>req_capsule.*_get()</tt> to change easily. One option would be to also change the <tt>swabber_dumper_helper()</tt> to print a CERROR() (so at least we know about the problem) and then return <tt>-EPROTO</tt> to the caller (which will also be ignored, but again improving the code for the future).</p> <p>Emoly Liu (emoly@whamcloud.com) uploaded a new patch: <a href="https://review.whamcloud.com/36848" class="external-link" target="_blank" rel="nofollow noopener">https://review.whamcloud.com/36848</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-12811" title="lustre_swab_fiemap needs to check fm_mapped_extents" class="issue-link" data-issue-key="LU-12811"><del>LU-12811</del></a> ptlrpc: do some cleanups in swabber_dumper_helper()<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: 1<br/> Commit: 937edd3c3324bc8ce659572a9e1f55c16636f5b4</p> <p>Emoly Liu (emoly@whamcloud.com) uploaded a new patch: <a href="https://review.whamcloud.com/36867" class="external-link" target="_blank" rel="nofollow noopener">https://review.whamcloud.com/36867</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-12811" title="lustre_swab_fiemap needs to check fm_mapped_extents" class="issue-link" data-issue-key="LU-12811"><del>LU-12811</del></a> ptlrpc: pass len to lustre_swab_object_update_reply()<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: 1<br/> Commit: 82be9af83291efe265171c1779b16493f6e6e180</p> <p>Oleg Drokin (green@whamcloud.com) merged in patch <a href="https://review.whamcloud.com/36435/" class="external-link" target="_blank" rel="nofollow noopener">https://review.whamcloud.com/36435/</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-12811" title="lustre_swab_fiemap needs to check fm_mapped_extents" class="issue-link" data-issue-key="LU-12811"><del>LU-12811</del></a> ptlrpc: pass buffer size to the swabbing functions<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: <br/> Commit: 6099136315e8f71c52ea720c7622a7c05b8e3640</p> <p>Oleg Drokin (green@whamcloud.com) merged in patch <a href="https://review.whamcloud.com/36867/" class="external-link" target="_blank" rel="nofollow noopener">https://review.whamcloud.com/36867/</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-12811" title="lustre_swab_fiemap needs to check fm_mapped_extents" class="issue-link" data-issue-key="LU-12811"><del>LU-12811</del></a> ptlrpc: pass buflen to lustre_swab_object_update_*()<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: <br/> Commit: c2a6f1a2afee6c416a3e7659b863bcc6246761f0</p> <p>Oleg Drokin (green@whamcloud.com) merged in patch <a href="https://review.whamcloud.com/36848/" class="external-link" target="_blank" rel="nofollow noopener">https://review.whamcloud.com/36848/</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-12811" title="lustre_swab_fiemap needs to check fm_mapped_extents" class="issue-link" data-issue-key="LU-12811"><del>LU-12811</del></a> ptlrpc: do some cleanups in swabber_dumper_helper()<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: <br/> Commit: 4b1ba33d7ab5f122e02b1cf8da4285b2ba798613</p> <p>It looks like all of these patches are landed.</p> Related LU-13592 LU-12742 Development Rank 1|i00nef: Rank (Obsolete) 9223372036854775807 Severity