Storage/posix : Adding error checks in path formation

Renaming directories can cause the size of the buffer
required for posix_handle_path to increase between the
first call, which calculates the size, and the second call
which forms the path in the buffer allocated based on
the size calculated in the first call.

The path created in the second call overflows the
allocated buffer and overwrites the stack causing the
brick process to crash.

The fix adds a buffer size check to prevent the buffer
overflow. It also checks and returns an error if the
posix_handle_path call is unable to form the path instead
of working on the incomplete path, which is likely to cause
subsequent calls using the path to fail with ELOOP.

Preventing buffer overflow and handling errors
BUG: 1113960

Change-Id: If3d3c1952e297ad14f121f05f90a35baf42923aa
Signed-off-by: Nithya Balachandran <nbalacha@redhat.com>
Reviewed-on: http://review.gluster.org/9289
Reviewed-by: Pranith Kumar Karampuri <pkarampu@redhat.com>
Tested-by: Gluster Build System <jenkins@build.gluster.com>
Reviewed-by: Raghavendra Bhat <raghavendra@redhat.com>

1 files changed, 28 insertions, 5 deletions

diff --git a/xlators/storage/posix/src/posix-helpers.c b/xlators/storage/posix/src/posix-helpers.c
index 62b0d2e10fe..2920f318709 100644
--- a/xlators/storage/posix/src/posix-helpers.c
+++ b/xlators/storage/posix/src/posix-helpers.c
@@ -465,10 +465,17 @@ posix_istat (xlator_t *this, uuid_t gfid, const char *basename,
         int          ret = 0;
         struct posix_private *priv = NULL;
 
-
         priv = this->private;
 
         MAKE_HANDLE_PATH (real_path, this, gfid, basename);
+        if (!real_path) {
+                gf_log (this->name, GF_LOG_ERROR,
+                        "Failed to create handle path for %s/%s",
+                        uuid_utoa (gfid), basename ? basename : "");
+                errno = ESTALE;
+                ret = -1;
+                goto out;
+        }
 
         ret = lstat (real_path, &lstatbuf);
 
@@ -819,6 +826,13 @@ posix_get_file_contents (xlator_t *this, uuid_t pargfid,
 
 
         MAKE_HANDLE_PATH (real_path, this, pargfid, name);
+        if (!real_path) {
+                op_ret = -ESTALE;
+                gf_log (this->name, GF_LOG_ERROR,
+                        "Failed to create handle path for %s/%s",
+                        uuid_utoa (pargfid), name);
+                goto out;
+        }
 
         op_ret = posix_istat (this, pargfid, name, &stbuf);
         if (op_ret == -1) {
@@ -1018,10 +1032,12 @@ del_stale_dir_handle (xlator_t *this, uuid_t gfid)
         }
 
         size = posix_handle_path (this, gfid, NULL, newpath, sizeof (newpath));
-        if (size <= 0 && errno == ENOENT) {
-                gf_log (this->name, GF_LOG_DEBUG, "%s: %s", newpath,
-                        strerror (ENOENT));
-                stale = _gf_true;
+        if (size <= 0) {
+                if (errno == ENOENT) {
+                        gf_log (this->name, GF_LOG_DEBUG, "%s: %s", newpath,
+                                strerror (ENOENT));
+                        stale = _gf_true;
+                }
                 goto out;
         }
 
@@ -1380,6 +1396,13 @@ __posix_fd_ctx_get (fd_t *fd, xlator_t *this, struct posix_fd **pfd_p)
                 goto out;
 
         MAKE_HANDLE_PATH (real_path, this, fd->inode->gfid, NULL);
+        if (!real_path) {
+                gf_log (this->name, GF_LOG_ERROR,
+                        "Failed to create handle path (%s)",
+                        uuid_utoa (fd->inode->gfid));
+                ret = -1;
+                goto out;
+        }
 
         pfd = GF_CALLOC (1, sizeof (*pfd), gf_posix_mt_posix_fd);
         if (!pfd) {