Lustre devel - Mar 2007 - [Bug 12054] New: mkfs.lustre does not perform proper bounds checking on mkfsoptions

Please don''t reply to lustre-devel. Instead, comment in Bugzilla by
using the following link:
https://bugzilla.lustre.org/show_bug.cgi?id=12054



mkfs.lustre reads mkfsoptions from the user and stores it in a fixed-length
string buffer with a bounds check to ensure the string from the user fits in
memory.  Unfortunately, it then adds various options to the string from the user
using strcat() without performing additional bounds checks.

Therefore if the user specifies an mkfsoptions string that is too long, the
options added internally will overflow the buffer and the program will behave
erratically.  For example:

]# mkfs.lustre --reformat --mdt --mgs --device-size=10000
--mkfsoptions="0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF"
/tmp/foo

   Permanent disk data:
Target:     lustre-MDTffff
Index:      unassigned
Lustre FS:  lustre
Mount type: ldiskfs
Flags:      0x75
              (MDT MGS needs_index first_time update )
Persistent mount opts: errors=remount-ro,iopen_nopriv,user_xattr
Parameters:

formatting backing filesystem ldiskfs on -i 4096 -I 512 -q -O dir_index -F
        target name  lustre-MDTffff
        4k blocks     2500
        options      
0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDE
-i 4096 -I 512 -q -O dir_index -F
mkfs_cmd = mkfs.ext2 -j -b 4096 -L lustre-MDTffff
0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDE
-i 4096 -I 512 -q -O dir_index -F -i 4096 -I 512 -q -O dir_index -F 2500
   mkfs.ext2: No such file or directory while trying to determine filesystem
size

mkfs.lustre FATAL: Unable to build fs -i 4096 -I 512 -q -O dir_index -F (256)

mkfs.lustre FATAL: mkfs failed 256
   losetup: invalid option -- i
   usage:
     losetup loop_device                                      # give info
     losetup -d loop_device                                   # delete
     losetup [ -e encryption ] [ -o offset ] loop_device file # setup
---
Here, the extra options overflowed into the loop device field and overwrote what
was previously there with "-i 4096 -I 512 -q -O dir_index -F"