summaryrefslogtreecommitdiffstats
path: root/fs/orangefs/upcall.h
diff options
context:
space:
mode:
authorMikulas Patocka <mpatocka@redhat.com>2022-11-01 16:53:35 -0400
committerMike Snitzer <snitzer@kernel.org>2022-11-18 10:23:55 -0500
commit4fe1ec995483737f3d2a14c3fe1d8fe634972979 (patch)
tree0a342344c0555913d6dd26d8ea8a61a90bcdc7e7 /fs/orangefs/upcall.h
parent094226ad94f471a9f19e8f8e7140a09c2625abaa (diff)
downloadlinux-4fe1ec995483737f3d2a14c3fe1d8fe634972979.tar.gz
linux-4fe1ec995483737f3d2a14c3fe1d8fe634972979.tar.bz2
linux-4fe1ec995483737f3d2a14c3fe1d8fe634972979.zip
dm ioctl: fix misbehavior if list_versions races with module loading
__list_versions will first estimate the required space using the "dm_target_iterate(list_version_get_needed, &needed)" call and then will fill the space using the "dm_target_iterate(list_version_get_info, &iter_info)" call. Each of these calls locks the targets using the "down_read(&_lock)" and "up_read(&_lock)" calls, however between the first and second "dm_target_iterate" there is no lock held and the target modules can be loaded at this point, so the second "dm_target_iterate" call may need more space than what was the first "dm_target_iterate" returned. The code tries to handle this overflow (see the beginning of list_version_get_info), however this handling is incorrect. The code sets "param->data_size = param->data_start + needed" and "iter_info.end = (char *)vers+len" - "needed" is the size returned by the first dm_target_iterate call; "len" is the size of the buffer allocated by userspace. "len" may be greater than "needed"; in this case, the code will write up to "len" bytes into the buffer, however param->data_size is set to "needed", so it may write data past the param->data_size value. The ioctl interface copies only up to param->data_size into userspace, thus part of the result will be truncated. Fix this bug by setting "iter_info.end = (char *)vers + needed;" - this guarantees that the second "dm_target_iterate" call will write only up to the "needed" buffer and it will exit with "DM_BUFFER_FULL_FLAG" if it overflows the "needed" space - in this case, userspace will allocate a larger buffer and retry. Note that there is also a bug in list_version_get_needed - we need to add "strlen(tt->name) + 1" to the needed size, not "strlen(tt->name)". Cc: stable@vger.kernel.org Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Diffstat (limited to 'fs/orangefs/upcall.h')
0 files changed, 0 insertions, 0 deletions