From f1c4ce0e220a46b7a43c9303c0d137498d421101 Mon Sep 17 00:00:00 2001 From: Nithya Balachandran Date: Wed, 17 Dec 2014 13:58:56 +0530 Subject: Storage/posix : Adding error checks in path formation Renaming directories can cause the size of the buffer required for posix_handle_path to increase between the first call, which calculates the size, and the second call which forms the path in the buffer allocated based on the size calculated in the first call. The path created in the second call overflows the allocated buffer and overwrites the stack causing the brick process to crash. The fix adds a buffer size check to prevent the buffer overflow. It also checks and returns an error if the posix_handle_path call is unable to form the path instead of working on the incomplete path, which is likely to cause subsequent calls using the path to fail with ELOOP. Preventing buffer overflow and handling errors BUG: 1113960 Change-Id: If3d3c1952e297ad14f121f05f90a35baf42923aa Signed-off-by: Nithya Balachandran Reviewed-on: http://review.gluster.org/9289 Reviewed-by: Pranith Kumar Karampuri Tested-by: Gluster Build System Reviewed-by: Raghavendra Bhat --- xlators/storage/posix/src/posix-handle.h | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) (limited to 'xlators/storage/posix/src/posix-handle.h') diff --git a/xlators/storage/posix/src/posix-handle.h b/xlators/storage/posix/src/posix-handle.h index 0ce9575251f..3af1a70b31a 100644 --- a/xlators/storage/posix/src/posix-handle.h +++ b/xlators/storage/posix/src/posix-handle.h @@ -146,6 +146,8 @@ break; \ var = alloca (__len); \ __len = posix_handle_path (this, gfid, base, var, __len); \ + if (__len <= 0) \ + var = NULL; \ } while (0) @@ -192,7 +194,13 @@ errno = 0; \ op_ret = posix_istat (this, loc->gfid, NULL, iatt_p); \ if (errno != ELOOP) { \ - MAKE_HANDLE_PATH (rpath, this, loc->gfid, NULL); \ + MAKE_HANDLE_PATH (rpath, this, (loc)->gfid, NULL); \ + if (!rpath) { \ + op_ret = -1; \ + gf_log (this->name, GF_LOG_ERROR, \ + "Failed to create inode handle " \ + "for path %s", (loc)->path); \ + } \ break; \ } \ /* __ret == -1 && errno == ELOOP */ \ @@ -220,6 +228,11 @@ if (errno != ELOOP) { \ MAKE_HANDLE_PATH (parp, this, loc->pargfid, NULL); \ MAKE_HANDLE_PATH (entp, this, loc->pargfid, loc->name); \ + if (!parp || !entp) { \ + gf_log (this->name, GF_LOG_ERROR, \ + "Failed to create entry handle " \ + "for path %s", loc->path); \ + } \ break; \ } \ /* __ret == -1 && errno == ELOOP */ \ -- cgit