[LU-3658] No user input verification in LL_IOC_HSM_REQUEST of ll_dir_ioctl()

Mon, 21 Oct 2013 20:28:49 +0000

the code snippet is as follows:

                /* We don't know the true size yet; copy the fixed-size part */
                if (copy_from_user(hur, (void *)arg, sizeof(*hur))) {
                        OBD_FREE_PTR(hur);
                        RETURN(-EFAULT);
                }

                /* Compute the whole struct size */
                totalsize = hur_len(hur);
                OBD_FREE_PTR(hur);
                OBD_ALLOC_LARGE(hur, totalsize);
                if (hur == NULL)
                        RETURN(-ENOMEM);

So if the user space program passes in a malicious data with huge hur_len, the kernel will be in trouble. We need to make sure the itemcount is reasonable.

Whamcloud Community JIRA

[LU-3658] No user input verification in LL_IOC_HSM_REQUEST of ll_dir_ioctl()