server: fix potential buffer overrun in bind string

[fio.git] / server.c

diff --git a/server.c b/server.c
index 9b13df8b5496226dd44fe310abc3d681c79aaa9f..9442764ed609a4d52ea472ef844a93f8f7dcbb45 100644 (file)
--- a/server.c
+++ b/server.c
@@ -987,9 +987,9 @@ void fio_server_send_ts(struct thread_stat *ts, struct group_run_stats *rs)
 
        memset(&p, 0, sizeof(p));
 
-       strcpy(p.ts.name, ts->name);
-       strcpy(p.ts.verror, ts->verror);
-       strcpy(p.ts.description, ts->description);
+       strncpy(p.ts.name, ts->name, FIO_JOBNAME_SIZE - 1);
+       strncpy(p.ts.verror, ts->verror, FIO_VERROR_SIZE - 1);
+       strncpy(p.ts.description, ts->description, FIO_JOBDESC_SIZE - 1);
 
        p.ts.error              = cpu_to_le32(ts->error);
        p.ts.thread_number      = cpu_to_le32(ts->thread_number);
@@ -1095,18 +1095,19 @@ static void convert_dus(struct disk_util_stat *dst, struct disk_util_stat *src)
 {
        int i;
 
-       strcpy((char *) dst->name, (char *) src->name);
+       dst->name[FIO_DU_NAME_SZ - 1] = '\0';
+       strncpy((char *) dst->name, (char *) src->name, FIO_DU_NAME_SZ - 1);
 
        for (i = 0; i < 2; i++) {
-               dst->ios[i]     = cpu_to_le32(src->ios[i]);
-               dst->merges[i]  = cpu_to_le32(src->merges[i]);
-               dst->sectors[i] = cpu_to_le64(src->sectors[i]);
-               dst->ticks[i]   = cpu_to_le32(src->ticks[i]);
+               dst->s.ios[i]           = cpu_to_le32(src->s.ios[i]);
+               dst->s.merges[i]        = cpu_to_le32(src->s.merges[i]);
+               dst->s.sectors[i]       = cpu_to_le64(src->s.sectors[i]);
+               dst->s.ticks[i]         = cpu_to_le32(src->s.ticks[i]);
        }
 
-       dst->io_ticks           = cpu_to_le32(src->io_ticks);
-       dst->time_in_queue      = cpu_to_le32(src->time_in_queue);
-       dst->msec               = cpu_to_le64(src->msec);
+       dst->s.io_ticks         = cpu_to_le32(src->s.io_ticks);
+       dst->s.time_in_queue    = cpu_to_le32(src->s.time_in_queue);
+       dst->s.msec             = cpu_to_le64(src->s.msec);
 }
 
 void fio_server_send_du(void)
@@ -1138,7 +1139,7 @@ static int fio_send_cmd_ext_pdu(int sk, uint16_t opcode, const void *buf,
        struct fio_net_cmd cmd;
        struct iovec iov[2];
 
-       iov[0].iov_base = &cmd;
+       iov[0].iov_base = (void *) &cmd;
        iov[0].iov_len = sizeof(cmd);
        iov[1].iov_base = (void *) buf;
        iov[1].iov_len = size;
@@ -1267,6 +1268,8 @@ static int fio_init_server_ip(void)
 {
        struct sockaddr *addr;
        socklen_t socklen;
+       char buf[80];
+       const char *str;
        int sk, opt;
 
        if (use_ipv6)
@@ -1294,17 +1297,24 @@ static int fio_init_server_ip(void)
 #endif
 
        if (use_ipv6) {
+               const void *src = &saddr_in6.sin6_addr;
+
                addr = (struct sockaddr *) &saddr_in6;
                socklen = sizeof(saddr_in6);
                saddr_in6.sin6_family = AF_INET6;
+               str = inet_ntop(AF_INET6, src, buf, sizeof(buf));
        } else {
+               const void *src = &saddr_in.sin_addr;
+
                addr = (struct sockaddr *) &saddr_in;
                socklen = sizeof(saddr_in);
                saddr_in.sin_family = AF_INET;
+               str = inet_ntop(AF_INET, src, buf, sizeof(buf));
        }
 
        if (bind(sk, addr, socklen) < 0) {
                log_err("fio: bind: %s\n", strerror(errno));
+               log_info("fio: failed with IPv%c %s\n", use_ipv6 ? '6' : '4', str);
                close(sk);
                return -1;
        }
@@ -1330,7 +1340,6 @@ static int fio_init_server_sock(void)
        memset(&addr, 0, sizeof(addr));
        addr.sun_family = AF_UNIX;
        strcpy(addr.sun_path, bind_sock);
-       unlink(bind_sock);
 
        len = sizeof(addr.sun_family) + strlen(bind_sock) + 1;
 
@@ -1359,6 +1368,8 @@ static int fio_init_server_connection(void)
        if (sk < 0)
                return sk;
 
+       memset(bind_str, 0, sizeof(bind_str));
+
        if (!bind_sock) {
                char *p, port[16];
                const void *src;
@@ -1378,27 +1389,28 @@ static int fio_init_server_connection(void)
                if (p)
                        strcat(p, port);
                else
-                       strcpy(bind_str, port);
+                       strncpy(bind_str, port, sizeof(bind_str) - 1);
        } else
-               strcpy(bind_str, bind_sock);
+               strncpy(bind_str, bind_sock, sizeof(bind_str) - 1);
 
        log_info("fio: server listening on %s\n", bind_str);
 
        if (listen(sk, 0) < 0) {
                log_err("fio: listen: %s\n", strerror(errno));
+               close(sk);
                return -1;
        }
 
        return sk;
 }
 
-int fio_server_parse_host(const char *host, int *ipv6, struct in_addr *inp,
+int fio_server_parse_host(const char *host, int ipv6, struct in_addr *inp,
                          struct in6_addr *inp6)
 
 {
        int ret = 0;
 
-       if (*ipv6)
+       if (ipv6)
                ret = inet_pton(AF_INET6, host, inp6);
        else
                ret = inet_pton(AF_INET, host, inp);
@@ -1407,17 +1419,17 @@ int fio_server_parse_host(const char *host, int *ipv6, struct in_addr *inp,
                struct addrinfo hints, *res;
 
                memset(&hints, 0, sizeof(hints));
-               hints.ai_family = *ipv6 ? AF_INET6 : AF_INET;
+               hints.ai_family = ipv6 ? AF_INET6 : AF_INET;
                hints.ai_socktype = SOCK_STREAM;
 
                ret = getaddrinfo(host, NULL, &hints, &res);
                if (ret) {
                        log_err("fio: failed to resolve <%s> (%s)\n", host,
                                        gai_strerror(ret));
-                       return 0;
+                       return 1;
                }
 
-               if (*ipv6)
+               if (ipv6)
                        memcpy(inp6, &((struct sockaddr_in6 *) res->ai_addr)->sin6_addr, sizeof(*inp6));
                else
                        memcpy(inp, &((struct sockaddr_in *) res->ai_addr)->sin_addr, sizeof(*inp));
@@ -1485,7 +1497,7 @@ int fio_server_parse_string(const char *str, char **ptr, int *is_sock,
        }
 
        /*
-        * If no port seen yet, check if there's a last ':' at the end
+        * If no port seen yet, check if there's a last ',' at the end
         */
        if (!lport) {
                portp = strchr(host, ',');
@@ -1508,7 +1520,7 @@ int fio_server_parse_string(const char *str, char **ptr, int *is_sock,
 
        *ptr = strdup(host);
 
-       if (fio_server_parse_host(*ptr, ipv6, inp, inp6)) {
+       if (fio_server_parse_host(*ptr, *ipv6, inp, inp6)) {
                free(*ptr);
                *ptr = NULL;
                return 1;
@@ -1558,6 +1570,22 @@ out:
        return ret;
 }
 
+static void sig_int(int sig)
+{
+       if (bind_sock)
+               unlink(bind_sock);
+}
+
+static void set_sig_handlers(void)
+{
+       struct sigaction act;
+
+       memset(&act, 0, sizeof(act));
+       act.sa_handler = sig_int;
+       act.sa_flags = SA_RESTART;
+       sigaction(SIGINT, &act, NULL);
+}
+
 static int fio_server(void)
 {
        int sk, ret;
@@ -1571,6 +1599,8 @@ static int fio_server(void)
        if (sk < 0)
                return -1;
 
+       set_sig_handlers();
+
        ret = accept_loop(sk);
 
        close(sk);
@@ -1656,6 +1686,7 @@ int fio_start_server(char *pidfile)
        if (check_existing_pidfile(pidfile)) {
                log_err("fio: pidfile %s exists and server appears alive\n",
                                                                pidfile);
+               free(pidfile);
                return -1;
        }
 
@@ -1667,6 +1698,7 @@ int fio_start_server(char *pidfile)
        } else if (pid) {
                int ret = write_pid(pid, pidfile);
 
+               free(pidfile);
                exit(ret);
        }