https://jira.whamcloud.com This file is an XML representation of an issue en-us 9.4.14 940014 05-12-2023 https://jira.whamcloud.com/browse/LU-12911 Lustre <p>The attribute passed to ll_setstripe_ea() is copied to a buffer allocated  based on size information passed from userspace.</p> <p>But the contents of this attribute are analyized and possibly changed (in ll_adjust_lum) <b>before</b> the size is validated.</p> <p>This can result in a warning from KASAN, and could result in memory corruption.</p> <p>The size should be validated before, or while, the attribute is examined.</p> <p> </p> LU-12911

Setting a LOV EA can access or change outside allocated buffer

Bug Minor Resolved Fixed Neil Brown Neil Brown Mon, 28 Oct 2019 01:01:29 +0000 Wed, 20 May 2020 12:41:51 +0000 Fri, 14 Feb 2020 13:47:46 +0000 Lustre 2.14.0 Lustre 2.12.5 0 2 <p>Neil Brown (neilb@suse.de) uploaded a new patch: <a href="https://review.whamcloud.com/36589" class="external-link" target="_blank" rel="nofollow noopener">https://review.whamcloud.com/36589</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-12911" title="Setting a LOV EA can access or change outside allocated buffer" class="issue-link" data-issue-key="LU-12911"><del>LU-12911</del></a> llite: Don't access lov_md fields before size check<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: 1<br/> Commit: 8b4a655f1828fd26ce18d5d74b6c4cdd68a4763e</p> <p>Oleg Drokin (green@whamcloud.com) merged in patch <a href="https://review.whamcloud.com/36589/" class="external-link" target="_blank" rel="nofollow noopener">https://review.whamcloud.com/36589/</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-12911" title="Setting a LOV EA can access or change outside allocated buffer" class="issue-link" data-issue-key="LU-12911"><del>LU-12911</del></a> llite: Don't access lov_md fields before size check<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: <br/> Commit: f2d06d3c76a1d69447e7bd6fd29d8165be558d73</p> <p>Landed for 2.14</p> <p>Andreas Dilger (adilger@whamcloud.com) uploaded a new patch: <a href="https://review.whamcloud.com/38433" class="external-link" target="_blank" rel="nofollow noopener">https://review.whamcloud.com/38433</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-12911" title="Setting a LOV EA can access or change outside allocated buffer" class="issue-link" data-issue-key="LU-12911"><del>LU-12911</del></a> llite: Don't access lov_md fields before size check<br/> Project: fs/lustre-release<br/> Branch: b2_12<br/> Current Patch Set: 1<br/> Commit: 22bb9a06d3012c2a17539460dbae0434a594a762</p> <p>Oleg Drokin (green@whamcloud.com) merged in patch <a href="https://review.whamcloud.com/38433/" class="external-link" target="_blank" rel="nofollow noopener">https://review.whamcloud.com/38433/</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-12911" title="Setting a LOV EA can access or change outside allocated buffer" class="issue-link" data-issue-key="LU-12911"><del>LU-12911</del></a> llite: Don't access lov_md fields before size check<br/> Project: fs/lustre-release<br/> Branch: b2_12<br/> Current Patch Set: <br/> Commit: 6b0011b8b9cd1a0fc5752512067ae2e384bf8adb</p> Duplicate LU-13168 Development Rank 1|i00onr: Rank (Obsolete) 9223372036854775807 Severity