[LU-7624] fld_proc_hash_seq_write accesses userspace pointer directly

Related — Fri, 23 Sep 2016 11:02:28 +0000

In lustre/fld/lproc_fld.c we have this gem:

static ssize_t
fld_proc_hash_seq_write(struct file *file, const char __user *buffer,
                        size_t count, loff_t *off)
{
...
                if (!strncmp(fld_hash[i].fh_name, buffer, count)) {
                        hash = &fld_hash[i];
                        break;
                }
...

This is a bug and we cannot really access user pointers directly. The value first must be copied to a kernel buffer.

This was introduced in 2006 by Yury, part of cmd3 bringup.

Whamcloud Community JIRA

[LU-7624] fld_proc_hash_seq_write accesses userspace pointer directly