all: fix the format string exceptions

Currently, there are possibilities in few places, where a user-controlled
(like filename, program parameter etc) string can be passed as 'fmt' for
printf(), which can lead to segfault, if the user's string contains '%s',
'%d' in it.

While fixing it, makes sense to make the explicit check for such issues
across the codebase, by making the format call properly.

Fixes: CVE-2018-14661

Fixes: bz#1644763
Change-Id: Ib547293f2d9eb618594cbff0df3b9c800e88bde4
Signed-off-by: Amar Tumballi <amarts@redhat.com>

9 files changed, 38 insertions, 40 deletions

diff --git a/xlators/performance/io-cache/src/io-cache.c b/xlators/performance/io-cache/src/io-cache.c
index 6ffad7d1a64..380ba876cba 100644
--- a/xlators/performance/io-cache/src/io-cache.c
+++ b/xlators/performance/io-cache/src/io-cache.c
@@ -1868,7 +1868,7 @@ __ioc_page_dump(ioc_page_t *page, char *prefix)
         goto out;
     {
         gf_proc_dump_write("offset", "%" PRId64, page->offset);
-        gf_proc_dump_write("size", "%" PRId64, page->size);
+        gf_proc_dump_write("size", "%" GF_PRI_SIZET, page->size);
         gf_proc_dump_write("dirty", "%s", page->dirty ? "yes" : "no");
         gf_proc_dump_write("ready", "%s", page->ready ? "yes" : "no");
         ioc_page_waitq_dump(page, prefix);
@@ -1962,7 +1962,7 @@ ioc_inode_dump(xlator_t *this, inode_t *inode)
         if (gf_uuid_is_null(ioc_inode->inode->gfid))
             goto unlock;
 
-        gf_proc_dump_add_section(key_prefix);
+        gf_proc_dump_add_section("%s", key_prefix);
         section_added = _gf_true;
 
         __inode_path(ioc_inode->inode, NULL, &path);
@@ -1985,7 +1985,7 @@ unlock:
 out:
     if (ret && ioc_inode) {
         if (section_added == _gf_false)
-            gf_proc_dump_add_section(key_prefix);
+            gf_proc_dump_add_section("%s", key_prefix);
         gf_proc_dump_write("Unable to print the status of ioc_inode",
                            "(Lock acquisition failed) %s",
                            uuid_utoa(inode->gfid));
@@ -2009,7 +2009,7 @@ ioc_priv_dump(xlator_t *this)
     priv = this->private;
 
     gf_proc_dump_build_key(key_prefix, "io-cache", "priv");
-    gf_proc_dump_add_section(key_prefix);
+    gf_proc_dump_add_section("%s", key_prefix);
     add_section = _gf_true;
 
     ret = pthread_mutex_trylock(&priv->table_lock);
@@ -2021,8 +2021,8 @@ ioc_priv_dump(xlator_t *this)
         gf_proc_dump_write("cache_used", "%ld", priv->cache_used);
         gf_proc_dump_write("inode_count", "%u", priv->inode_count);
         gf_proc_dump_write("cache_timeout", "%u", priv->cache_timeout);
-        gf_proc_dump_write("min-file-size", "%u", priv->min_file_size);
-        gf_proc_dump_write("max-file-size", "%u", priv->max_file_size);
+        gf_proc_dump_write("min-file-size", "%" PRIu64, priv->min_file_size);
+        gf_proc_dump_write("max-file-size", "%" PRIu64, priv->max_file_size);
     }
     pthread_mutex_unlock(&priv->table_lock);
 out:
@@ -2032,7 +2032,7 @@ out:
                                    "xlator."
                                    "performance.io-cache",
                                    "priv");
-            gf_proc_dump_add_section(key_prefix);
+            gf_proc_dump_add_section("%s", key_prefix);
         }
         gf_proc_dump_write(
             "Unable to dump the state of private "
diff --git a/xlators/performance/io-threads/src/io-threads.c b/xlators/performance/io-threads/src/io-threads.c
index 7f1a34676d9..80d42ded5eb 100644
--- a/xlators/performance/io-threads/src/io-threads.c
+++ b/xlators/performance/io-threads/src/io-threads.c
@@ -937,7 +937,7 @@ iot_priv_dump(xlator_t *this)
 
     snprintf(key_prefix, GF_DUMP_MAX_BUF_LEN, "%s.%s", this->type, this->name);
 
-    gf_proc_dump_add_section(key_prefix);
+    gf_proc_dump_add_section("%s", key_prefix);
 
     gf_proc_dump_write("maximum_threads_count", "%d", conf->max_count);
     gf_proc_dump_write("current_threads_count", "%d", conf->curr_count);
diff --git a/xlators/performance/md-cache/src/md-cache.c b/xlators/performance/md-cache/src/md-cache.c
index 700666957c1..bf4b6399549 100644
--- a/xlators/performance/md-cache/src/md-cache.c
+++ b/xlators/performance/md-cache/src/md-cache.c
@@ -3063,7 +3063,7 @@ mdc_priv_dump(xlator_t *this)
     conf = this->private;
 
     snprintf(key_prefix, GF_DUMP_MAX_BUF_LEN, "%s.%s", this->type, this->name);
-    gf_proc_dump_add_section(key_prefix);
+    gf_proc_dump_add_section("%s", key_prefix);
 
     gf_proc_dump_write("stat_hit_count", "%" PRId64,
                        GF_ATOMIC_GET(conf->mdc_counter.stat_hit));
diff --git a/xlators/performance/nl-cache/src/nl-cache-helper.c b/xlators/performance/nl-cache/src/nl-cache-helper.c
index f2954a83228..279c023a5b1 100644
--- a/xlators/performance/nl-cache/src/nl-cache-helper.c
+++ b/xlators/performance/nl-cache/src/nl-cache-helper.c
@@ -1161,7 +1161,7 @@ nlc_dump_inodectx(xlator_t *this, inode_t *inode)
     if (!ret) {
         gf_proc_dump_build_key(key_prefix, "xlator.performance.nl-cache",
                                "nlc_inode");
-        gf_proc_dump_add_section(key_prefix);
+        gf_proc_dump_add_section("%s", key_prefix);
 
         __inode_path(inode, NULL, &path);
         if (path != NULL) {
@@ -1176,14 +1176,14 @@ nlc_dump_inodectx(xlator_t *this, inode_t *inode)
 
         gf_proc_dump_write("state", "%" PRIu64, nlc_ctx->state);
         gf_proc_dump_write("timer", "%p", nlc_ctx->timer);
-        gf_proc_dump_write("cache-time", "%lld", nlc_ctx->cache_time);
+        gf_proc_dump_write("cache-time", "%" GF_PRI_TIME, nlc_ctx->cache_time);
         gf_proc_dump_write("cache-size", "%zu", nlc_ctx->cache_size);
         gf_proc_dump_write("refd-inodes", "%" PRIu64, nlc_ctx->refd_inodes);
 
         if (IS_PE_VALID(nlc_ctx->state))
             list_for_each_entry_safe(pe, tmp, &nlc_ctx->pe, list)
             {
-                gf_proc_dump_write("pe", "%p, %s", pe, pe->inode, pe->name);
+                gf_proc_dump_write("pe", "%p, %p, %s", pe, pe->inode, pe->name);
             }
 
         if (IS_NE_VALID(nlc_ctx->state))
diff --git a/xlators/performance/nl-cache/src/nl-cache.c b/xlators/performance/nl-cache/src/nl-cache.c
index efa54ee346b..02d6df55349 100644
--- a/xlators/performance/nl-cache/src/nl-cache.c
+++ b/xlators/performance/nl-cache/src/nl-cache.c
@@ -588,7 +588,7 @@ nlc_priv_dump(xlator_t *this)
     conf = this->private;
 
     snprintf(key_prefix, GF_DUMP_MAX_BUF_LEN, "%s.%s", this->type, this->name);
-    gf_proc_dump_add_section(key_prefix);
+    gf_proc_dump_add_section("%s", key_prefix);
 
     gf_proc_dump_write("negative_lookup_hit_count", "%" PRId64,
                        GF_ATOMIC_GET(conf->nlc_counter.nlc_hit));
diff --git a/xlators/performance/open-behind/src/open-behind.c b/xlators/performance/open-behind/src/open-behind.c
index 8021fd07a2e..6164b3b046d 100644
--- a/xlators/performance/open-behind/src/open-behind.c
+++ b/xlators/performance/open-behind/src/open-behind.c
@@ -1130,7 +1130,7 @@ ob_priv_dump(xlator_t *this)
     gf_proc_dump_build_key(key_prefix, "xlator.performance.open-behind",
                            "priv");
 
-    gf_proc_dump_add_section(key_prefix);
+    gf_proc_dump_add_section("%s", key_prefix);
 
     gf_proc_dump_write("use_anonymous_fd", "%d", conf->use_anonymous_fd);
 
@@ -1160,14 +1160,14 @@ ob_fdctx_dump(xlator_t *this, fd_t *fd)
 
     gf_proc_dump_build_key(key_prefix, "xlator.performance.open-behind",
                            "file");
-    gf_proc_dump_add_section(key_prefix);
+    gf_proc_dump_add_section("%s", key_prefix);
 
     gf_proc_dump_write("fd", "%p", fd);
 
     gf_proc_dump_write("open_frame", "%p", ob_fd->open_frame);
 
     if (ob_fd->open_frame)
-        gf_proc_dump_write("open_frame.root.unique", "%p",
+        gf_proc_dump_write("open_frame.root.unique", "%" PRIu64,
                            ob_fd->open_frame->root->unique);
 
     gf_proc_dump_write("loc.path", "%s", ob_fd->loc.path);
diff --git a/xlators/performance/quick-read/src/quick-read.c b/xlators/performance/quick-read/src/quick-read.c
index 21734607390..ea61a2ec302 100644
--- a/xlators/performance/quick-read/src/quick-read.c
+++ b/xlators/performance/quick-read/src/quick-read.c
@@ -1044,7 +1044,7 @@ qr_inodectx_dump(xlator_t *this, inode_t *inode)
 
     gf_proc_dump_build_key(key_prefix, "xlator.performance.quick-read",
                            "inodectx");
-    gf_proc_dump_add_section(key_prefix);
+    gf_proc_dump_add_section("%s", key_prefix);
 
     gf_proc_dump_write("entire-file-cached", "%s",
                        qr_inode->data ? "yes" : "no");
@@ -1088,9 +1088,9 @@ qr_priv_dump(xlator_t *this)
 
     gf_proc_dump_build_key(key_prefix, "xlator.performance.quick-read", "priv");
 
-    gf_proc_dump_add_section(key_prefix);
+    gf_proc_dump_add_section("%s", key_prefix);
 
-    gf_proc_dump_write("max_file_size", "%d", conf->max_file_size);
+    gf_proc_dump_write("max_file_size", "%" PRIu64, conf->max_file_size);
     gf_proc_dump_write("cache_timeout", "%d", conf->cache_timeout);
 
     if (!table) {
@@ -1106,11 +1106,13 @@ qr_priv_dump(xlator_t *this)
     }
 
     gf_proc_dump_write("total_files_cached", "%d", file_count);
-    gf_proc_dump_write("total_cache_used", "%d", total_size);
-    gf_proc_dump_write("cache-hit", "%" PRId64, priv->qr_counter.cache_hit);
-    gf_proc_dump_write("cache-miss", "%" PRId64, priv->qr_counter.cache_miss);
-    gf_proc_dump_write("cache-invalidations", "%" PRId64,
-                       priv->qr_counter.file_data_invals);
+    gf_proc_dump_write("total_cache_used", "%" PRIu64, total_size);
+    gf_proc_dump_write("cache-hit", "%" GF_PRI_ATOMIC,
+                       GF_ATOMIC_GET(priv->qr_counter.cache_hit));
+    gf_proc_dump_write("cache-miss", "%" GF_PRI_ATOMIC,
+                       GF_ATOMIC_GET(priv->qr_counter.cache_miss));
+    gf_proc_dump_write("cache-invalidations", "%" GF_PRI_ATOMIC,
+                       GF_ATOMIC_GET(priv->qr_counter.file_data_invals));
 
 out:
     return 0;
diff --git a/xlators/performance/read-ahead/src/read-ahead.c b/xlators/performance/read-ahead/src/read-ahead.c
index 2fdb56479ab..c62bd1bb172 100644
--- a/xlators/performance/read-ahead/src/read-ahead.c
+++ b/xlators/performance/read-ahead/src/read-ahead.c
@@ -744,7 +744,7 @@ ra_page_dump(struct ra_page *page)
 
     gf_proc_dump_write("offset", "%" PRId64, page->offset);
 
-    gf_proc_dump_write("size", "%" PRId64, page->size);
+    gf_proc_dump_write("size", "%" GF_PRI_SIZET, page->size);
 
     gf_proc_dump_write("dirty", "%s", page->dirty ? "yes" : "no");
 
@@ -770,9 +770,6 @@ ra_fdctx_dump(xlator_t *this, fd_t *fd)
     int32_t ret = 0, i = 0;
     uint64_t tmp_file = 0;
     char *path = NULL;
-    char key[GF_DUMP_MAX_BUF_LEN] = {
-        0,
-    };
     char key_prefix[GF_DUMP_MAX_BUF_LEN] = {
         0,
     };
@@ -787,7 +784,7 @@ ra_fdctx_dump(xlator_t *this, fd_t *fd)
 
     gf_proc_dump_build_key(key_prefix, "xlator.performance.read-ahead", "file");
 
-    gf_proc_dump_add_section(key_prefix);
+    gf_proc_dump_add_section("%s", key_prefix);
 
     ret = __inode_path(fd->inode, NULL, &path);
     if (path != NULL) {
@@ -812,8 +809,7 @@ ra_fdctx_dump(xlator_t *this, fd_t *fd)
                        file->offset);
 
     for (page = file->pages.next; page != &file->pages; page = page->next) {
-        sprintf(key, "page[%d]", i);
-        gf_proc_dump_write(key, "%p", page[i++]);
+        gf_proc_dump_write("page", "%d: %p", i++, (void *)page);
         ra_page_dump(page);
     }
 
@@ -1040,14 +1036,14 @@ ra_priv_dump(xlator_t *this)
 
     gf_proc_dump_build_key(key_prefix, "xlator.performance.read-ahead", "priv");
 
-    gf_proc_dump_add_section(key_prefix);
+    gf_proc_dump_add_section("%s", key_prefix);
     add_section = _gf_true;
 
     ret = pthread_mutex_trylock(&conf->conf_lock);
     if (ret)
         goto out;
     {
-        gf_proc_dump_write("page_size", "%d", conf->page_size);
+        gf_proc_dump_write("page_size", "%" PRIu64, conf->page_size);
         gf_proc_dump_write("page_count", "%d", conf->page_count);
         gf_proc_dump_write("force_atime_update", "%d",
                            conf->force_atime_update);
@@ -1058,7 +1054,7 @@ ra_priv_dump(xlator_t *this)
 out:
     if (ret && conf) {
         if (add_section == _gf_false)
-            gf_proc_dump_add_section(key_prefix);
+            gf_proc_dump_add_section("%s", key_prefix);
 
         gf_proc_dump_write("Unable to dump priv",
                            "(Lock acquisition failed) %s", this->name);
diff --git a/xlators/performance/write-behind/src/write-behind.c b/xlators/performance/write-behind/src/write-behind.c
index 473c8e9320a..b46a42f300f 100644
--- a/xlators/performance/write-behind/src/write-behind.c
+++ b/xlators/performance/write-behind/src/write-behind.c
@@ -2843,10 +2843,10 @@ wb_priv_dump(xlator_t *this)
     gf_proc_dump_build_key(key_prefix, "xlator.performance.write-behind",
                            "priv");
 
-    gf_proc_dump_add_section(key_prefix);
+    gf_proc_dump_add_section("%s", key_prefix);
 
-    gf_proc_dump_write("aggregate_size", "%d", conf->aggregate_size);
-    gf_proc_dump_write("window_size", "%d", conf->window_size);
+    gf_proc_dump_write("aggregate_size", "%" PRIu64, conf->aggregate_size);
+    gf_proc_dump_write("window_size", "%" PRIu64, conf->window_size);
     gf_proc_dump_write("flush_behind", "%d", conf->flush_behind);
     gf_proc_dump_write("trickling_writes", "%d", conf->trickling_writes);
 
@@ -2873,7 +2873,7 @@ __wb_dump_requests(struct list_head *head, char *prefix)
         gf_proc_dump_build_key(key_prefix, key, "%s",
                                (char *)gf_fop_list[req->fop]);
 
-        gf_proc_dump_add_section(key_prefix);
+        gf_proc_dump_add_section("%s", key_prefix);
 
         gf_proc_dump_write("unique", "%" PRIu64, req->unique);
 
@@ -2884,7 +2884,7 @@ __wb_dump_requests(struct list_head *head, char *prefix)
         else
             gf_proc_dump_write("wound", "no");
 
-        gf_proc_dump_write("generation-number", "%d", req->gen);
+        gf_proc_dump_write("generation-number", "%" PRIu64, req->gen);
 
         gf_proc_dump_write("req->op_ret", "%d", req->op_ret);
         gf_proc_dump_write("req->op_errno", "%d", req->op_errno);
@@ -2946,7 +2946,7 @@ wb_inode_dump(xlator_t *this, inode_t *inode)
     gf_proc_dump_build_key(key_prefix, "xlator.performance.write-behind",
                            "wb_inode");
 
-    gf_proc_dump_add_section(key_prefix);
+    gf_proc_dump_add_section("%s", key_prefix);
 
     __inode_path(inode, NULL, &path);
     if (path != NULL) {