From 83304fedb464fe3f97db662ce3e07bd948b7b7d9 Mon Sep 17 00:00:00 2001 From: Amar Tumballi Date: Tue, 6 Nov 2018 22:47:41 +0530 Subject: all: fix the format string exceptions Currently, there are possibilities in few places, where a user-controlled (like filename, program parameter etc) string can be passed as 'fmt' for printf(), which can lead to segfault, if the user's string contains '%s', '%d' in it. While fixing it, makes sense to make the explicit check for such issues across the codebase, by making the format call properly. Fixes: CVE-2018-14661 Fixes: bz#1647666 Change-Id: Ib547293f2d9eb618594cbff0df3b9c800e88bde4 Signed-off-by: Amar Tumballi --- xlators/performance/io-cache/src/io-cache.c | 14 +++++++------- xlators/performance/io-threads/src/io-threads.c | 2 +- xlators/performance/md-cache/src/md-cache.c | 2 +- xlators/performance/nl-cache/src/nl-cache-helper.c | 6 +++--- xlators/performance/nl-cache/src/nl-cache.c | 2 +- xlators/performance/open-behind/src/open-behind.c | 6 +++--- xlators/performance/quick-read/src/quick-read.c | 18 ++++++++++-------- xlators/performance/read-ahead/src/read-ahead.c | 16 ++++++---------- xlators/performance/write-behind/src/write-behind.c | 12 ++++++------ 9 files changed, 38 insertions(+), 40 deletions(-) (limited to 'xlators/performance') diff --git a/xlators/performance/io-cache/src/io-cache.c b/xlators/performance/io-cache/src/io-cache.c index 843fc36396a..cea8667fe43 100644 --- a/xlators/performance/io-cache/src/io-cache.c +++ b/xlators/performance/io-cache/src/io-cache.c @@ -1860,7 +1860,7 @@ __ioc_page_dump(ioc_page_t *page, char *prefix) goto out; { gf_proc_dump_write("offset", "%" PRId64, page->offset); - gf_proc_dump_write("size", "%" PRId64, page->size); + gf_proc_dump_write("size", "%" GF_PRI_SIZET, page->size); gf_proc_dump_write("dirty", "%s", page->dirty ? "yes" : "no"); gf_proc_dump_write("ready", "%s", page->ready ? "yes" : "no"); ioc_page_waitq_dump(page, prefix); @@ -1954,7 +1954,7 @@ ioc_inode_dump(xlator_t *this, inode_t *inode) if (gf_uuid_is_null(ioc_inode->inode->gfid)) goto unlock; - gf_proc_dump_add_section(key_prefix); + gf_proc_dump_add_section("%s", key_prefix); section_added = _gf_true; __inode_path(ioc_inode->inode, NULL, &path); @@ -1977,7 +1977,7 @@ unlock: out: if (ret && ioc_inode) { if (section_added == _gf_false) - gf_proc_dump_add_section(key_prefix); + gf_proc_dump_add_section("%s", key_prefix); gf_proc_dump_write("Unable to print the status of ioc_inode", "(Lock acquisition failed) %s", uuid_utoa(inode->gfid)); @@ -2001,7 +2001,7 @@ ioc_priv_dump(xlator_t *this) priv = this->private; gf_proc_dump_build_key(key_prefix, "io-cache", "priv"); - gf_proc_dump_add_section(key_prefix); + gf_proc_dump_add_section("%s", key_prefix); add_section = _gf_true; ret = pthread_mutex_trylock(&priv->table_lock); @@ -2013,8 +2013,8 @@ ioc_priv_dump(xlator_t *this) gf_proc_dump_write("cache_used", "%ld", priv->cache_used); gf_proc_dump_write("inode_count", "%u", priv->inode_count); gf_proc_dump_write("cache_timeout", "%u", priv->cache_timeout); - gf_proc_dump_write("min-file-size", "%u", priv->min_file_size); - gf_proc_dump_write("max-file-size", "%u", priv->max_file_size); + gf_proc_dump_write("min-file-size", "%" PRIu64, priv->min_file_size); + gf_proc_dump_write("max-file-size", "%" PRIu64, priv->max_file_size); } pthread_mutex_unlock(&priv->table_lock); out: @@ -2024,7 +2024,7 @@ out: "xlator." "performance.io-cache", "priv"); - gf_proc_dump_add_section(key_prefix); + gf_proc_dump_add_section("%s", key_prefix); } gf_proc_dump_write( "Unable to dump the state of private " diff --git a/xlators/performance/io-threads/src/io-threads.c b/xlators/performance/io-threads/src/io-threads.c index 78678adb859..8c51f09a01d 100644 --- a/xlators/performance/io-threads/src/io-threads.c +++ b/xlators/performance/io-threads/src/io-threads.c @@ -935,7 +935,7 @@ iot_priv_dump(xlator_t *this) snprintf(key_prefix, GF_DUMP_MAX_BUF_LEN, "%s.%s", this->type, this->name); - gf_proc_dump_add_section(key_prefix); + gf_proc_dump_add_section("%s", key_prefix); gf_proc_dump_write("maximum_threads_count", "%d", conf->max_count); gf_proc_dump_write("current_threads_count", "%d", conf->curr_count); diff --git a/xlators/performance/md-cache/src/md-cache.c b/xlators/performance/md-cache/src/md-cache.c index b151110a081..02fc79e2267 100644 --- a/xlators/performance/md-cache/src/md-cache.c +++ b/xlators/performance/md-cache/src/md-cache.c @@ -3022,7 +3022,7 @@ mdc_priv_dump(xlator_t *this) conf = this->private; snprintf(key_prefix, GF_DUMP_MAX_BUF_LEN, "%s.%s", this->type, this->name); - gf_proc_dump_add_section(key_prefix); + gf_proc_dump_add_section("%s", key_prefix); gf_proc_dump_write("stat_hit_count", "%" PRId64, GF_ATOMIC_GET(conf->mdc_counter.stat_hit)); diff --git a/xlators/performance/nl-cache/src/nl-cache-helper.c b/xlators/performance/nl-cache/src/nl-cache-helper.c index 063172019b1..b057ed4b5d6 100644 --- a/xlators/performance/nl-cache/src/nl-cache-helper.c +++ b/xlators/performance/nl-cache/src/nl-cache-helper.c @@ -1159,7 +1159,7 @@ nlc_dump_inodectx(xlator_t *this, inode_t *inode) if (!ret) { gf_proc_dump_build_key(key_prefix, "xlator.performance.nl-cache", "nlc_inode"); - gf_proc_dump_add_section(key_prefix); + gf_proc_dump_add_section("%s", key_prefix); __inode_path(inode, NULL, &path); if (path != NULL) { @@ -1174,14 +1174,14 @@ nlc_dump_inodectx(xlator_t *this, inode_t *inode) gf_proc_dump_write("state", "%" PRIu64, nlc_ctx->state); gf_proc_dump_write("timer", "%p", nlc_ctx->timer); - gf_proc_dump_write("cache-time", "%lld", nlc_ctx->cache_time); + gf_proc_dump_write("cache-time", "%" GF_PRI_TIME, nlc_ctx->cache_time); gf_proc_dump_write("cache-size", "%zu", nlc_ctx->cache_size); gf_proc_dump_write("refd-inodes", "%" PRIu64, nlc_ctx->refd_inodes); if (IS_PE_VALID(nlc_ctx->state)) list_for_each_entry_safe(pe, tmp, &nlc_ctx->pe, list) { - gf_proc_dump_write("pe", "%p, %s", pe, pe->inode, pe->name); + gf_proc_dump_write("pe", "%p, %p, %s", pe, pe->inode, pe->name); } if (IS_NE_VALID(nlc_ctx->state)) diff --git a/xlators/performance/nl-cache/src/nl-cache.c b/xlators/performance/nl-cache/src/nl-cache.c index efa54ee346b..02d6df55349 100644 --- a/xlators/performance/nl-cache/src/nl-cache.c +++ b/xlators/performance/nl-cache/src/nl-cache.c @@ -588,7 +588,7 @@ nlc_priv_dump(xlator_t *this) conf = this->private; snprintf(key_prefix, GF_DUMP_MAX_BUF_LEN, "%s.%s", this->type, this->name); - gf_proc_dump_add_section(key_prefix); + gf_proc_dump_add_section("%s", key_prefix); gf_proc_dump_write("negative_lookup_hit_count", "%" PRId64, GF_ATOMIC_GET(conf->nlc_counter.nlc_hit)); diff --git a/xlators/performance/open-behind/src/open-behind.c b/xlators/performance/open-behind/src/open-behind.c index c8f818717ef..fdfbca450d6 100644 --- a/xlators/performance/open-behind/src/open-behind.c +++ b/xlators/performance/open-behind/src/open-behind.c @@ -1130,7 +1130,7 @@ ob_priv_dump(xlator_t *this) gf_proc_dump_build_key(key_prefix, "xlator.performance.open-behind", "priv"); - gf_proc_dump_add_section(key_prefix); + gf_proc_dump_add_section("%s", key_prefix); gf_proc_dump_write("use_anonymous_fd", "%d", conf->use_anonymous_fd); @@ -1160,14 +1160,14 @@ ob_fdctx_dump(xlator_t *this, fd_t *fd) gf_proc_dump_build_key(key_prefix, "xlator.performance.open-behind", "file"); - gf_proc_dump_add_section(key_prefix); + gf_proc_dump_add_section("%s", key_prefix); gf_proc_dump_write("fd", "%p", fd); gf_proc_dump_write("open_frame", "%p", ob_fd->open_frame); if (ob_fd->open_frame) - gf_proc_dump_write("open_frame.root.unique", "%p", + gf_proc_dump_write("open_frame.root.unique", "%" PRIu64, ob_fd->open_frame->root->unique); gf_proc_dump_write("loc.path", "%s", ob_fd->loc.path); diff --git a/xlators/performance/quick-read/src/quick-read.c b/xlators/performance/quick-read/src/quick-read.c index ec545ba6193..265abc8f3b1 100644 --- a/xlators/performance/quick-read/src/quick-read.c +++ b/xlators/performance/quick-read/src/quick-read.c @@ -1040,7 +1040,7 @@ qr_inodectx_dump(xlator_t *this, inode_t *inode) gf_proc_dump_build_key(key_prefix, "xlator.performance.quick-read", "inodectx"); - gf_proc_dump_add_section(key_prefix); + gf_proc_dump_add_section("%s", key_prefix); gf_proc_dump_write("entire-file-cached", "%s", qr_inode->data ? "yes" : "no"); @@ -1084,9 +1084,9 @@ qr_priv_dump(xlator_t *this) gf_proc_dump_build_key(key_prefix, "xlator.performance.quick-read", "priv"); - gf_proc_dump_add_section(key_prefix); + gf_proc_dump_add_section("%s", key_prefix); - gf_proc_dump_write("max_file_size", "%d", conf->max_file_size); + gf_proc_dump_write("max_file_size", "%" PRIu64, conf->max_file_size); gf_proc_dump_write("cache_timeout", "%d", conf->cache_timeout); if (!table) { @@ -1102,11 +1102,13 @@ qr_priv_dump(xlator_t *this) } gf_proc_dump_write("total_files_cached", "%d", file_count); - gf_proc_dump_write("total_cache_used", "%d", total_size); - gf_proc_dump_write("cache-hit", "%" PRId64, priv->qr_counter.cache_hit); - gf_proc_dump_write("cache-miss", "%" PRId64, priv->qr_counter.cache_miss); - gf_proc_dump_write("cache-invalidations", "%" PRId64, - priv->qr_counter.file_data_invals); + gf_proc_dump_write("total_cache_used", "%" PRIu64, total_size); + gf_proc_dump_write("cache-hit", "%" GF_PRI_ATOMIC, + GF_ATOMIC_GET(priv->qr_counter.cache_hit)); + gf_proc_dump_write("cache-miss", "%" GF_PRI_ATOMIC, + GF_ATOMIC_GET(priv->qr_counter.cache_miss)); + gf_proc_dump_write("cache-invalidations", "%" GF_PRI_ATOMIC, + GF_ATOMIC_GET(priv->qr_counter.file_data_invals)); out: return 0; diff --git a/xlators/performance/read-ahead/src/read-ahead.c b/xlators/performance/read-ahead/src/read-ahead.c index 2fdb56479ab..c62bd1bb172 100644 --- a/xlators/performance/read-ahead/src/read-ahead.c +++ b/xlators/performance/read-ahead/src/read-ahead.c @@ -744,7 +744,7 @@ ra_page_dump(struct ra_page *page) gf_proc_dump_write("offset", "%" PRId64, page->offset); - gf_proc_dump_write("size", "%" PRId64, page->size); + gf_proc_dump_write("size", "%" GF_PRI_SIZET, page->size); gf_proc_dump_write("dirty", "%s", page->dirty ? "yes" : "no"); @@ -770,9 +770,6 @@ ra_fdctx_dump(xlator_t *this, fd_t *fd) int32_t ret = 0, i = 0; uint64_t tmp_file = 0; char *path = NULL; - char key[GF_DUMP_MAX_BUF_LEN] = { - 0, - }; char key_prefix[GF_DUMP_MAX_BUF_LEN] = { 0, }; @@ -787,7 +784,7 @@ ra_fdctx_dump(xlator_t *this, fd_t *fd) gf_proc_dump_build_key(key_prefix, "xlator.performance.read-ahead", "file"); - gf_proc_dump_add_section(key_prefix); + gf_proc_dump_add_section("%s", key_prefix); ret = __inode_path(fd->inode, NULL, &path); if (path != NULL) { @@ -812,8 +809,7 @@ ra_fdctx_dump(xlator_t *this, fd_t *fd) file->offset); for (page = file->pages.next; page != &file->pages; page = page->next) { - sprintf(key, "page[%d]", i); - gf_proc_dump_write(key, "%p", page[i++]); + gf_proc_dump_write("page", "%d: %p", i++, (void *)page); ra_page_dump(page); } @@ -1040,14 +1036,14 @@ ra_priv_dump(xlator_t *this) gf_proc_dump_build_key(key_prefix, "xlator.performance.read-ahead", "priv"); - gf_proc_dump_add_section(key_prefix); + gf_proc_dump_add_section("%s", key_prefix); add_section = _gf_true; ret = pthread_mutex_trylock(&conf->conf_lock); if (ret) goto out; { - gf_proc_dump_write("page_size", "%d", conf->page_size); + gf_proc_dump_write("page_size", "%" PRIu64, conf->page_size); gf_proc_dump_write("page_count", "%d", conf->page_count); gf_proc_dump_write("force_atime_update", "%d", conf->force_atime_update); @@ -1058,7 +1054,7 @@ ra_priv_dump(xlator_t *this) out: if (ret && conf) { if (add_section == _gf_false) - gf_proc_dump_add_section(key_prefix); + gf_proc_dump_add_section("%s", key_prefix); gf_proc_dump_write("Unable to dump priv", "(Lock acquisition failed) %s", this->name); diff --git a/xlators/performance/write-behind/src/write-behind.c b/xlators/performance/write-behind/src/write-behind.c index c4f53e425bc..62974db93de 100644 --- a/xlators/performance/write-behind/src/write-behind.c +++ b/xlators/performance/write-behind/src/write-behind.c @@ -2837,10 +2837,10 @@ wb_priv_dump(xlator_t *this) gf_proc_dump_build_key(key_prefix, "xlator.performance.write-behind", "priv"); - gf_proc_dump_add_section(key_prefix); + gf_proc_dump_add_section("%s", key_prefix); - gf_proc_dump_write("aggregate_size", "%d", conf->aggregate_size); - gf_proc_dump_write("window_size", "%d", conf->window_size); + gf_proc_dump_write("aggregate_size", "%" PRIu64, conf->aggregate_size); + gf_proc_dump_write("window_size", "%" PRIu64, conf->window_size); gf_proc_dump_write("flush_behind", "%d", conf->flush_behind); gf_proc_dump_write("trickling_writes", "%d", conf->trickling_writes); @@ -2867,7 +2867,7 @@ __wb_dump_requests(struct list_head *head, char *prefix) gf_proc_dump_build_key(key_prefix, key, "%s", (char *)gf_fop_list[req->fop]); - gf_proc_dump_add_section(key_prefix); + gf_proc_dump_add_section("%s", key_prefix); gf_proc_dump_write("unique", "%" PRIu64, req->unique); @@ -2878,7 +2878,7 @@ __wb_dump_requests(struct list_head *head, char *prefix) else gf_proc_dump_write("wound", "no"); - gf_proc_dump_write("generation-number", "%d", req->gen); + gf_proc_dump_write("generation-number", "%" PRIu64, req->gen); gf_proc_dump_write("req->op_ret", "%d", req->op_ret); gf_proc_dump_write("req->op_errno", "%d", req->op_errno); @@ -2940,7 +2940,7 @@ wb_inode_dump(xlator_t *this, inode_t *inode) gf_proc_dump_build_key(key_prefix, "xlator.performance.write-behind", "wb_inode"); - gf_proc_dump_add_section(key_prefix); + gf_proc_dump_add_section("%s", key_prefix); __inode_path(inode, NULL, &path); if (path != NULL) { -- cgit