diff options
| author |   Oleg Drokin <green@linuxhacker.ru> | 2014-04-27 13:07:10 -0400 |
|---|---|---|
| committer |   Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2014-04-27 10:31:01 -0700 |
| commit | a1e7e2d4deab583593e427b3bf9dd62823d81fbc (patch) | |
| tree | 40b68af364df9c55a03c63b54b47836c9bb188d9 /drivers/staging/lustre/lustre/osc/lproc_osc.c | |
| parent | staging/lustre: pass fsync() range through RPC/IO stack (diff) | |
| download | linux-dev-a1e7e2d4deab583593e427b3bf9dd62823d81fbc.tar.xz linux-dev-a1e7e2d4deab583593e427b3bf9dd62823d81fbc.zip | |
staging/lustre: Fix unsafe userspace access in many proc files
Apparently we are pretty bad about verifying our buffers passed
from userspace.
Signed-off-by: Oleg Drokin <oleg.drokin@intel.com>
Reviewed-on: http://review.whamcloud.com/9059
Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-4563
Reviewed-by: Dmitry Eremin <dmitry.eremin@intel.com>
Reviewed-by: James Simmons <uja.ornl@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/lustre/lustre/osc/lproc_osc.c')
| -rw-r--r-- | drivers/staging/lustre/lustre/osc/lproc_osc.c | 16 |
1 files changed, 13 insertions, 3 deletions
diff --git a/drivers/staging/lustre/lustre/osc/lproc_osc.c b/drivers/staging/lustre/lustre/osc/lproc_osc.c index 0b59fc16c50c..358e32cd05d2 100644 --- a/drivers/staging/lustre/lustre/osc/lproc_osc.c +++ b/drivers/staging/lustre/lustre/osc/lproc_osc.c @@ -174,15 +174,25 @@ static int osc_cached_mb_seq_show(struct seq_file *m, void *v) } /* shrink the number of caching pages to a specific number */ -static ssize_t osc_cached_mb_seq_write(struct file *file, const char *buffer, - size_t count, loff_t *off) +static ssize_t osc_cached_mb_seq_write(struct file *file, + const char __user *buffer, + size_t count, loff_t *off) { struct obd_device *dev = ((struct seq_file *)file->private_data)->private; struct client_obd *cli = &dev->u.cli; int pages_number, mult, rc; + char kernbuf[128]; + + if (count >= sizeof(kernbuf)) + return -EINVAL; + + if (copy_from_user(kernbuf, buffer, count)) + return -EFAULT; + kernbuf[count] = 0; mult = 1 << (20 - PAGE_CACHE_SHIFT); - buffer = lprocfs_find_named_value(buffer, "used_mb:", &count); + buffer += lprocfs_find_named_value(kernbuf, "used_mb:", &count) - + kernbuf; rc = lprocfs_write_frac_helper(buffer, count, &pages_number, mult); if (rc) return rc; |