From patchwork Mon May 25 22:07:59 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Simmons X-Patchwork-Id: 11569577 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 718F460D for ; Mon, 25 May 2020 22:10:11 +0000 (UTC) Received: from pdx1-mailman02.dreamhost.com (pdx1-mailman02.dreamhost.com [64.90.62.194]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 5A9AD2071A for ; Mon, 25 May 2020 22:10:11 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 5A9AD2071A Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=infradead.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=lustre-devel-bounces@lists.lustre.org Received: from pdx1-mailman02.dreamhost.com (localhost [IPv6:::1]) by pdx1-mailman02.dreamhost.com (Postfix) with ESMTP id 7C8F32475EF; Mon, 25 May 2020 15:09:29 -0700 (PDT) X-Original-To: lustre-devel@lists.lustre.org Delivered-To: lustre-devel-lustre.org@pdx1-mailman02.dreamhost.com Received: from smtp4.ccs.ornl.gov (smtp4.ccs.ornl.gov [160.91.203.40]) by pdx1-mailman02.dreamhost.com (Postfix) with ESMTP id 1E14921F75D for ; Mon, 25 May 2020 15:08:37 -0700 (PDT) Received: from star.ccs.ornl.gov (star.ccs.ornl.gov [160.91.202.134]) by smtp4.ccs.ornl.gov (Postfix) with ESMTP id 3875E1005873; Mon, 25 May 2020 18:08:27 -0400 (EDT) Received: by star.ccs.ornl.gov (Postfix, from userid 2004) id 361DC495; Mon, 25 May 2020 18:08:27 -0400 (EDT) From: James Simmons To: Andreas Dilger , Oleg Drokin , NeilBrown Date: Mon, 25 May 2020 18:07:59 -0400 Message-Id: <1590444502-20533-23-git-send-email-jsimmons@infradead.org> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1590444502-20533-1-git-send-email-jsimmons@infradead.org> References: <1590444502-20533-1-git-send-email-jsimmons@infradead.org> Subject: [lustre-devel] [PATCH 22/45] lustre: llite: verify truncated xattr is handled X-BeenThere: lustre-devel@lists.lustre.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "For discussing Lustre software development." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Lustre Development List MIME-Version: 1.0 Errors-To: lustre-devel-bounces@lists.lustre.org Sender: "lustre-devel" From: Andreas Dilger Verify that a truncated trusted.lov xattr is handled properly, for both plain and PFL layouts. Add a test case that verifies this is fixed for both layout types. Fixes: 814b53f76d ("lustre: llite: Don't access lov_md fields before size check") WC-bug-id: https://jira.whamcloud.com/browse/LU-13168 Lustre-commit: cb74546354201 ("LU-13168 tests: verify truncated xattr is handled") Signed-off-by: Andreas Dilger Reviewed-on: https://review.whamcloud.com/38434 Reviewed-by: Sebastien Buisson Reviewed-by: Emoly Liu Reviewed-by: Oleg Drokin Signed-off-by: James Simmons --- fs/lustre/llite/xattr.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/fs/lustre/llite/xattr.c b/fs/lustre/llite/xattr.c index 9e7ba21..119fb26 100644 --- a/fs/lustre/llite/xattr.c +++ b/fs/lustre/llite/xattr.c @@ -190,7 +190,8 @@ static int get_hsm_state(struct inode *inode, u32 *hus_states) return rc; } -static int ll_adjust_lum(struct inode *inode, struct lov_user_md *lump) +static int ll_adjust_lum(struct inode *inode, struct lov_user_md *lump, + size_t size) { struct lov_comp_md_v1 *comp_v1 = (struct lov_comp_md_v1 *)lump; struct lov_user_md *v1 = lump; @@ -205,7 +206,12 @@ static int ll_adjust_lum(struct inode *inode, struct lov_user_md *lump) return 0; if (lump->lmm_magic == LOV_USER_MAGIC_COMP_V1) { + if (size < sizeof(*comp_v1)) + return -ERANGE; + entry_count = comp_v1->lcm_entry_count; + if (size < offsetof(typeof(*comp_v1), lcm_entries[entry_count])) + return -ERANGE; is_composite = true; } @@ -213,6 +219,10 @@ static int ll_adjust_lum(struct inode *inode, struct lov_user_md *lump) if (lump->lmm_magic == LOV_USER_MAGIC_COMP_V1) { void *ptr = comp_v1; + if (comp_v1->lcm_entries[i].lcme_offset + sizeof(*v1) > + size) + return -ERANGE; + ptr += comp_v1->lcm_entries[i].lcme_offset; v1 = (struct lov_user_md *)ptr; } @@ -265,7 +275,7 @@ static int ll_setstripe_ea(struct dentry *dentry, struct lov_user_md *lump, return -ERANGE; } - rc = ll_adjust_lum(inode, lump); + rc = ll_adjust_lum(inode, lump, size); if (rc) return rc;