[LU-4984] Integer overflow in LL_IOC_HSM_REQUEST handler

Related — Mon, 1 Dec 2014 08:41:27 +0000

There's an integer overflow in LL_IOC_HSM_REQUEST handler

        case LL_IOC_HSM_REQUEST: {
                struct hsm_user_request *hur;
                int                      totalsize;

                OBD_ALLOC_PTR(hur);
                if (hur == NULL)
                        RETURN(-ENOMEM);

                /* We don't know the true size yet; copy the fixed-size part */
                if (copy_from_user(hur, (void *)arg, sizeof(*hur))) {
                        OBD_FREE_PTR(hur);
                        RETURN(-EFAULT);
                }

                /* Compute the whole struct size */
                totalsize = hur_len(hur);
                OBD_FREE_PTR(hur);

                /* Make sure the size is reasonable */
                if (totalsize >= MDS_MAXREQSIZE)
                        RETURN(-E2BIG);

Instead of checking totalsize which is past multiplication and is subject to overflow already, what we must do is we must ensure hur->hur_request.hr_itemcount is safe first.
Then it's safe to call hur_len

Whamcloud Community JIRA

[LU-4984] Integer overflow in LL_IOC_HSM_REQUEST handler