[PATCH] staging: lustre: lustre: Off by two in lmv_fid2path()

[PATCH] staging: lustre: lustre: Off by two in lmv_fid2path()

[Dan Carpenter]

We want to concatonate join string one, a '/' character, string two and
then a NUL terminator.  The destination buffer holds ori_gf->gf_pathlen
characters.  The strlen() function returns the number of characters not
counting the NUL terminator.  So we should be adding two extra spaces,
one for the foward slash and one for the NUL.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
Not tested.  Please review this one carefully.

diff --git a/drivers/staging/lustre/lustre/lmv/lmv_obd.c b/drivers/staging/lustre/lustre/lmv/lmv_obd.c
index 64fcaef0bacd..70c58291814d 100644
--- a/drivers/staging/lustre/lustre/lmv/lmv_obd.c
+++ b/drivers/staging/lustre/lustre/lmv/lmv_obd.c
@@ -657,8 +657,8 @@ static int lmv_fid2path(struct obd_export *exp, int len, void *karg,
 		char *ptr;
 
 		ori_gf = karg;
-		if (strlen(ori_gf->gf_path) +
-		    strlen(gf->gf_path) > ori_gf->gf_pathlen) {
+		if (strlen(ori_gf->gf_path) + 1 +
+		    strlen(gf->gf_path) + 1 > ori_gf->gf_pathlen) {
 			rc = -EOVERFLOW;
 			goto out_fid2path;
 		}

Re: [PATCH] staging: lustre: lustre: Off by two in lmv_fid2path()

[James Simmons]

> We want to concatonate join string one, a '/' character, string two and
> then a NUL terminator.  The destination buffer holds ori_gf->gf_pathlen
> characters.  The strlen() function returns the number of characters not
> counting the NUL terminator.  So we should be adding two extra spaces,
> one for the foward slash and one for the NUL.
> 
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> Not tested.  Please review this one carefully.

This is a real bug which is impacting users. The bug is being tracked
at https://jira.hpdd.intel.com/browse/LU-9863. It passed our test suite
and its being reviewed.
 
> diff --git a/drivers/staging/lustre/lustre/lmv/lmv_obd.c b/drivers/staging/lustre/lustre/lmv/lmv_obd.c
> index 64fcaef0bacd..70c58291814d 100644
> --- a/drivers/staging/lustre/lustre/lmv/lmv_obd.c
> +++ b/drivers/staging/lustre/lustre/lmv/lmv_obd.c
> @@ -657,8 +657,8 @@ static int lmv_fid2path(struct obd_export *exp, int len, void *karg,
>  		char *ptr;
>  
>  		ori_gf = karg;
> -		if (strlen(ori_gf->gf_path) +
> -		    strlen(gf->gf_path) > ori_gf->gf_pathlen) {
> +		if (strlen(ori_gf->gf_path) + 1 +
> +		    strlen(gf->gf_path) + 1 > ori_gf->gf_pathlen) {
>  			rc = -EOVERFLOW;
>  			goto out_fid2path;
>  		}
> 

Re: [PATCH] staging: lustre: lustre: Off by two in lmv_fid2path()

[Greg Kroah-Hartman]

On Mon, Aug 14, 2017 at 04:01:17PM +0100, James Simmons wrote:
> 
> > We want to concatonate join string one, a '/' character, string two and
> > then a NUL terminator.  The destination buffer holds ori_gf->gf_pathlen
> > characters.  The strlen() function returns the number of characters not
> > counting the NUL terminator.  So we should be adding two extra spaces,
> > one for the foward slash and one for the NUL.
> > 
> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> > ---
> > Not tested.  Please review this one carefully.
> 
> This is a real bug which is impacting users. The bug is being tracked
> at https://jira.hpdd.intel.com/browse/LU-9863. It passed our test suite
> and its being reviewed.

So what am I supposed to do with this patch?

Re: [PATCH] staging: lustre: lustre: Off by two in lmv_fid2path()

[Dilger, Andreas]

> On Aug 17, 2017, at 09:47, Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
> 
> On Mon, Aug 14, 2017 at 04:01:17PM +0100, James Simmons wrote:
>> 
>>> We want to concatonate join string one, a '/' character, string two and
>>> then a NUL terminator.  The destination buffer holds ori_gf->gf_pathlen
>>> characters.  The strlen() function returns the number of characters not
>>> counting the NUL terminator.  So we should be adding two extra spaces,
>>> one for the foward slash and one for the NUL.
>>> 
>>> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>>> ---
>>> Not tested.  Please review this one carefully.
>> 
>> This is a real bug which is impacting users. The bug is being tracked
>> at https://jira.hpdd.intel.com/browse/LU-9863. It passed our test suite
>> and its being reviewed.
> 
> So what am I supposed to do with this patch?

The patch has been reviewed and you could add them before landing:

Reviewed-by: John L. Hammond <john.hammond@intel.com>
Reviewed-by: frank zago <fzago@cray.com>

Cheers, Andreas
--
Andreas Dilger
Lustre Principal Architect
Intel Corporation