Commit 661489ad authored by Sebastien Buisson's avatar Sebastien Buisson Committed by Greg Kroah-Hartman

staging: lustre: fix 'copy into fixed size buffer' errors

Fix 'copy into fixed size buffer' defects found by Coverity
version 6.0.3:
Copy into fixed size buffer (STRING_OVERFLOW)
The fixed-size string might be overrun by copying without
checking the length.
Signed-off-by: default avatarSebastien Buisson <sebastien.buisson@bull.net>
Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-2074
Reviewed-on: http://review.whamcloud.com/4154Reviewed-by: default avatarDmitry Eremin <dmitry.eremin@intel.com>
Reviewed-by: default avatarOleg Drokin <oleg.drokin@intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 5412d816
...@@ -99,7 +99,10 @@ lnet_ipif_query(char *name, int *up, __u32 *ip, __u32 *mask) ...@@ -99,7 +99,10 @@ lnet_ipif_query(char *name, int *up, __u32 *ip, __u32 *mask)
CLASSERT(sizeof(ifr.ifr_name) >= IFNAMSIZ); CLASSERT(sizeof(ifr.ifr_name) >= IFNAMSIZ);
strcpy(ifr.ifr_name, name); if (strlen(name) > sizeof(ifr.ifr_name) - 1)
return -E2BIG;
strncpy(ifr.ifr_name, name, sizeof(ifr.ifr_name));
rc = lnet_sock_ioctl(SIOCGIFFLAGS, (unsigned long)&ifr); rc = lnet_sock_ioctl(SIOCGIFFLAGS, (unsigned long)&ifr);
if (rc) { if (rc) {
CERROR("Can't get flags for interface %s\n", name); CERROR("Can't get flags for interface %s\n", name);
...@@ -114,7 +117,10 @@ lnet_ipif_query(char *name, int *up, __u32 *ip, __u32 *mask) ...@@ -114,7 +117,10 @@ lnet_ipif_query(char *name, int *up, __u32 *ip, __u32 *mask)
} }
*up = 1; *up = 1;
strcpy(ifr.ifr_name, name); if (strlen(name) > sizeof(ifr.ifr_name) - 1)
return -E2BIG;
strncpy(ifr.ifr_name, name, sizeof(ifr.ifr_name));
ifr.ifr_addr.sa_family = AF_INET; ifr.ifr_addr.sa_family = AF_INET;
rc = lnet_sock_ioctl(SIOCGIFADDR, (unsigned long)&ifr); rc = lnet_sock_ioctl(SIOCGIFADDR, (unsigned long)&ifr);
if (rc) { if (rc) {
...@@ -125,7 +131,10 @@ lnet_ipif_query(char *name, int *up, __u32 *ip, __u32 *mask) ...@@ -125,7 +131,10 @@ lnet_ipif_query(char *name, int *up, __u32 *ip, __u32 *mask)
val = ((struct sockaddr_in *)&ifr.ifr_addr)->sin_addr.s_addr; val = ((struct sockaddr_in *)&ifr.ifr_addr)->sin_addr.s_addr;
*ip = ntohl(val); *ip = ntohl(val);
strcpy(ifr.ifr_name, name); if (strlen(name) > sizeof(ifr.ifr_name) - 1)
return -E2BIG;
strncpy(ifr.ifr_name, name, sizeof(ifr.ifr_name));
ifr.ifr_addr.sa_family = AF_INET; ifr.ifr_addr.sa_family = AF_INET;
rc = lnet_sock_ioctl(SIOCGIFNETMASK, (unsigned long)&ifr); rc = lnet_sock_ioctl(SIOCGIFNETMASK, (unsigned long)&ifr);
if (rc) { if (rc) {
......
...@@ -206,8 +206,14 @@ lstcon_group_alloc(char *name, lstcon_group_t **grpp) ...@@ -206,8 +206,14 @@ lstcon_group_alloc(char *name, lstcon_group_t **grpp)
return -ENOMEM; return -ENOMEM;
grp->grp_ref = 1; grp->grp_ref = 1;
if (name) if (name) {
strcpy(grp->grp_name, name); if (strlen(name) > sizeof(grp->grp_name)-1) {
LIBCFS_FREE(grp, offsetof(lstcon_group_t,
grp_ndl_hash[LST_NODE_HASHSIZE]));
return -E2BIG;
}
strncpy(grp->grp_name, name, sizeof(grp->grp_name));
}
INIT_LIST_HEAD(&grp->grp_link); INIT_LIST_HEAD(&grp->grp_link);
INIT_LIST_HEAD(&grp->grp_ndl_list); INIT_LIST_HEAD(&grp->grp_ndl_list);
...@@ -873,7 +879,13 @@ lstcon_batch_add(char *name) ...@@ -873,7 +879,13 @@ lstcon_batch_add(char *name)
return -ENOMEM; return -ENOMEM;
} }
strcpy(bat->bat_name, name); if (strlen(name) > sizeof(bat->bat_name) - 1) {
LIBCFS_FREE(bat->bat_srv_hash, LST_NODE_HASHSIZE);
LIBCFS_FREE(bat->bat_cli_hash, LST_NODE_HASHSIZE);
LIBCFS_FREE(bat, sizeof(lstcon_batch_t));
return -E2BIG;
}
strncpy(bat->bat_name, name, sizeof(bat->bat_name));
bat->bat_hdr.tsb_index = 0; bat->bat_hdr.tsb_index = 0;
bat->bat_hdr.tsb_id.bat_id = ++console_session.ses_id_cookie; bat->bat_hdr.tsb_id.bat_id = ++console_session.ses_id_cookie;
...@@ -1733,7 +1745,10 @@ lstcon_session_new(char *name, int key, unsigned feats, ...@@ -1733,7 +1745,10 @@ lstcon_session_new(char *name, int key, unsigned feats,
console_session.ses_feats_updated = 0; console_session.ses_feats_updated = 0;
console_session.ses_timeout = (timeout <= 0) ? console_session.ses_timeout = (timeout <= 0) ?
LST_CONSOLE_TIMEOUT : timeout; LST_CONSOLE_TIMEOUT : timeout;
strlcpy(console_session.ses_name, name,
if (strlen(name) > sizeof(console_session.ses_name)-1)
return -E2BIG;
strncpy(console_session.ses_name, name,
sizeof(console_session.ses_name)); sizeof(console_session.ses_name));
rc = lstcon_batch_add(LST_DEFAULT_BATCH); rc = lstcon_batch_add(LST_DEFAULT_BATCH);
......
...@@ -351,7 +351,11 @@ cfs_wi_sched_create(char *name, struct cfs_cpt_table *cptab, ...@@ -351,7 +351,11 @@ cfs_wi_sched_create(char *name, struct cfs_cpt_table *cptab,
if (!sched) if (!sched)
return -ENOMEM; return -ENOMEM;
strlcpy(sched->ws_name, name, CFS_WS_NAME_LEN); if (strlen(name) > sizeof(sched->ws_name) - 1) {
LIBCFS_FREE(sched, sizeof(*sched));
return -E2BIG;
}
strncpy(sched->ws_name, name, sizeof(sched->ws_name));
sched->ws_cptab = cptab; sched->ws_cptab = cptab;
sched->ws_cpt = cpt; sched->ws_cpt = cpt;
......
...@@ -1094,6 +1094,7 @@ static int ptlrpc_nrs_policy_register(struct ptlrpc_nrs_pol_conf *conf) ...@@ -1094,6 +1094,7 @@ static int ptlrpc_nrs_policy_register(struct ptlrpc_nrs_pol_conf *conf)
{ {
struct ptlrpc_service *svc; struct ptlrpc_service *svc;
struct ptlrpc_nrs_pol_desc *desc; struct ptlrpc_nrs_pol_desc *desc;
size_t len;
int rc = 0; int rc = 0;
LASSERT(conf->nc_ops); LASSERT(conf->nc_ops);
...@@ -1137,7 +1138,12 @@ static int ptlrpc_nrs_policy_register(struct ptlrpc_nrs_pol_conf *conf) ...@@ -1137,7 +1138,12 @@ static int ptlrpc_nrs_policy_register(struct ptlrpc_nrs_pol_conf *conf)
goto fail; goto fail;
} }
strncpy(desc->pd_name, conf->nc_name, NRS_POL_NAME_MAX); len = strlcpy(desc->pd_name, conf->nc_name, sizeof(desc->pd_name));
if (len >= sizeof(desc->pd_name)) {
kfree(desc);
rc = -E2BIG;
goto fail;
}
desc->pd_ops = conf->nc_ops; desc->pd_ops = conf->nc_ops;
desc->pd_compat = conf->nc_compat; desc->pd_compat = conf->nc_compat;
desc->pd_compat_svc_name = conf->nc_compat_svc_name; desc->pd_compat_svc_name = conf->nc_compat_svc_name;
......
...@@ -517,6 +517,7 @@ struct sptlrpc_conf *sptlrpc_conf_get(const char *fsname, ...@@ -517,6 +517,7 @@ struct sptlrpc_conf *sptlrpc_conf_get(const char *fsname,
int create) int create)
{ {
struct sptlrpc_conf *conf; struct sptlrpc_conf *conf;
size_t len;
list_for_each_entry(conf, &sptlrpc_confs, sc_list) { list_for_each_entry(conf, &sptlrpc_confs, sc_list) {
if (strcmp(conf->sc_fsname, fsname) == 0) if (strcmp(conf->sc_fsname, fsname) == 0)
...@@ -530,7 +531,11 @@ struct sptlrpc_conf *sptlrpc_conf_get(const char *fsname, ...@@ -530,7 +531,11 @@ struct sptlrpc_conf *sptlrpc_conf_get(const char *fsname,
if (!conf) if (!conf)
return NULL; return NULL;
strcpy(conf->sc_fsname, fsname); len = strlcpy(conf->sc_fsname, fsname, sizeof(conf->sc_fsname));
if (len >= sizeof(conf->sc_fsname)) {
kfree(conf);
return NULL;
}
sptlrpc_rule_set_init(&conf->sc_rset); sptlrpc_rule_set_init(&conf->sc_rset);
INIT_LIST_HEAD(&conf->sc_tgts); INIT_LIST_HEAD(&conf->sc_tgts);
list_add(&conf->sc_list, &sptlrpc_confs); list_add(&conf->sc_list, &sptlrpc_confs);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment