From patchwork Thu Feb 27 21:12:20 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Simmons X-Patchwork-Id: 11410103 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 5379717E0 for ; Thu, 27 Feb 2020 21:30:17 +0000 (UTC) Received: from pdx1-mailman02.dreamhost.com (pdx1-mailman02.dreamhost.com [64.90.62.194]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 3994C246A1 for ; Thu, 27 Feb 2020 21:30:17 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 3994C246A1 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=infradead.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=lustre-devel-bounces@lists.lustre.org Received: from pdx1-mailman02.dreamhost.com (localhost [IPv6:::1]) by pdx1-mailman02.dreamhost.com (Postfix) with ESMTP id 4870F348F29; Thu, 27 Feb 2020 13:25:54 -0800 (PST) X-Original-To: lustre-devel@lists.lustre.org Delivered-To: lustre-devel-lustre.org@pdx1-mailman02.dreamhost.com Received: from smtp3.ccs.ornl.gov (smtp3.ccs.ornl.gov [160.91.203.39]) by pdx1-mailman02.dreamhost.com (Postfix) with ESMTP id 957DE21FC75 for ; Thu, 27 Feb 2020 13:19:41 -0800 (PST) Received: from star.ccs.ornl.gov (star.ccs.ornl.gov [160.91.202.134]) by smtp3.ccs.ornl.gov (Postfix) with ESMTP id 84B388A23; Thu, 27 Feb 2020 16:18:16 -0500 (EST) Received: by star.ccs.ornl.gov (Postfix, from userid 2004) id 836CE46C; Thu, 27 Feb 2020 16:18:16 -0500 (EST) From: James Simmons To: Andreas Dilger , Oleg Drokin , NeilBrown Date: Thu, 27 Feb 2020 16:12:20 -0500 Message-Id: <1582838290-17243-273-git-send-email-jsimmons@infradead.org> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1582838290-17243-1-git-send-email-jsimmons@infradead.org> References: <1582838290-17243-1-git-send-email-jsimmons@infradead.org> Subject: [lustre-devel] [PATCH 272/622] lustre: llite: fill copied dentry name's ending char properly X-BeenThere: lustre-devel@lists.lustre.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "For discussing Lustre software development." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Wang Shilong , Lustre Development List MIME-Version: 1.0 Errors-To: lustre-devel-bounces@lists.lustre.org Sender: "lustre-devel" From: Wang Shilong Dentry name expect an extra '\0'. and dentry_len won't calcualte extra '\0' for it, but we should allocate memory and fill it when copying dentry name by ourselves. Otherwise, lu_name_is_valid_2() will try to access @name[len] and check whether it is '\0'. this is invalid memory access. We will possibly hit a crash if the first access that bit is '\0'. and the bit overwritten by someone else, and finally we failed sanity check in mdc_name_pack(). LustreError: 157839:0:(mdc_lib.c:137:mdc_pack_name()) LBUG Fixes: 2eae6a4 ("lustre: llite: make sure name pack atomic") WC-bug-id: https://jira.whamcloud.com/browse/LU-12169 Lustre-commit: bc9cc327983c ("LU-12169 llite: fill copied dentry name's ending char properly") Signed-off-by: Wang Shilong Reviewed-on: https://review.whamcloud.com/34611 Reviewed-by: Andreas Dilger Reviewed-by: Gu Zheng Reviewed-by: Oleg Drokin Signed-off-by: James Simmons --- fs/lustre/include/obd_support.h | 1 + fs/lustre/llite/file.c | 10 ++++++---- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/fs/lustre/include/obd_support.h b/fs/lustre/include/obd_support.h index 9ebdcb6..4e956da 100644 --- a/fs/lustre/include/obd_support.h +++ b/fs/lustre/include/obd_support.h @@ -456,6 +456,7 @@ #define OBD_FAIL_LLITE_CREATE_NODE_PAUSE 0x140c #define OBD_FAIL_LLITE_IMUTEX_SEC 0x140e #define OBD_FAIL_LLITE_IMUTEX_NOSEC 0x140f +#define OBD_FAIL_LLITE_OPEN_BY_NAME 0x1410 #define OBD_FAIL_FID_INDIR 0x1501 #define OBD_FAIL_FID_INLMA 0x1502 diff --git a/fs/lustre/llite/file.c b/fs/lustre/llite/file.c index 0f15ea8..61d53c4 100644 --- a/fs/lustre/llite/file.c +++ b/fs/lustre/llite/file.c @@ -513,12 +513,14 @@ static int ll_intent_file_open(struct dentry *de, void *lmm, int lmmsize, * if server supports open-by-fid, or file name is invalid, don't pack * name in open request */ - if (!(exp_connect_flags(sbi->ll_md_exp) & OBD_CONNECT_OPEN_BY_FID)) { + if (OBD_FAIL_CHECK(OBD_FAIL_LLITE_OPEN_BY_NAME) || + !(exp_connect_flags(sbi->ll_md_exp) & OBD_CONNECT_OPEN_BY_FID)) { retry: len = de->d_name.len; - name = kmalloc(len, GFP_NOFS); + name = kmalloc(len + 1, GFP_NOFS); if (!name) return -ENOMEM; + /* race here */ spin_lock(&de->d_lock); if (len != de->d_name.len) { @@ -527,12 +529,12 @@ static int ll_intent_file_open(struct dentry *de, void *lmm, int lmmsize, goto retry; } memcpy(name, de->d_name.name, len); + name[len] = '\0'; spin_unlock(&de->d_lock); if (!lu_name_is_valid_2(name, len)) { kfree(name); - name = NULL; - len = 0; + return -ESTALE; } }