]> CyberLeo.Net >> Repos - FreeBSD/FreeBSD.git/commit
MFC r311305 (by asomers):
authormav <mav@FreeBSD.org>
Thu, 23 Mar 2017 06:40:20 +0000 (06:40 +0000)
committermav <mav@FreeBSD.org>
Thu, 23 Mar 2017 06:40:20 +0000 (06:40 +0000)
commitac0b8ac0de8c7dfa4c384cf95592608a8e51ad6b
tree6e9df05cb67fe928cbc688fa65d444bdb8a97f29
parentf37700e920785f69d2c175aab95f60a8ecc9c517
MFC r311305 (by asomers):
Always null-terminate ccb_pathinq.(sim_vid|hba_vid|dev_name)

The sim_vid, hba_vid, and dev_name fields of struct ccb_pathinq are
fixed-length strings. AFAICT the only place they're read is in
sbin/camcontrol/camcontrol.c, which assumes they'll be null-terminated.
However, the kernel doesn't null-terminate them. A bunch of copy-pasted code
uses strncpy to write them, and doesn't guarantee null-termination. For at
least 4 drivers (mpr, mps, ciss, and hyperv), the hba_vid field actually
overflows. You can see the result by doing "camcontrol negotiate da0 -v".

This change null-terminates those fields everywhere they're set in the
kernel. It also shortens a few strings to ensure they'll fit within the
16-character field.

PR: 215474
Reported by:    Coverity
CID:            1009997 1010000 1010001 1010002 1010003 1010004 1010005
CID:            1331519 1010006 1215097 1010007 1288967 1010008 1306000
CID:            1211924 1010009 1010010 1010011 1010012 1010013 1010014
CID:            1147190 1010017 1010016 1010018 1216435 1010020 1010021
CID:            1010022 1009666 1018185 1010023 1010025 1010026 1010027
CID:            1010028 1010029 1010030 1010031 1010033 1018186 1018187
CID:            1010035 1010036 1010042 1010041 1010040 1010039
51 files changed:
sys/cam/cam_xpt.c
sys/cam/ctl/ctl_frontend_cam_sim.c
sys/cam/scsi/scsi_low.c
sys/dev/aac/aac_cam.c
sys/dev/aacraid/aacraid_cam.c
sys/dev/advansys/advansys.c
sys/dev/advansys/adwcam.c
sys/dev/aha/aha.c
sys/dev/ahb/ahb.c
sys/dev/ahci/ahci.c
sys/dev/ahci/ahciem.c
sys/dev/aic/aic.c
sys/dev/aic7xxx/aic79xx_osm.c
sys/dev/aic7xxx/aic7xxx_osm.c
sys/dev/amr/amr_cam.c
sys/dev/arcmsr/arcmsr.c
sys/dev/ata/ata-all.c
sys/dev/buslogic/bt.c
sys/dev/ciss/ciss.c
sys/dev/dpt/dpt_scsi.c
sys/dev/esp/ncr53c9x.c
sys/dev/firewire/sbp.c
sys/dev/firewire/sbp_targ.c
sys/dev/hpt27xx/hpt27xx_osm_bsd.c
sys/dev/hptiop/hptiop.c
sys/dev/hptmv/entry.c
sys/dev/hptnr/hptnr_osm_bsd.c
sys/dev/hptrr/hptrr_osm_bsd.c
sys/dev/hyperv/storvsc/hv_storvsc_drv_freebsd.c
sys/dev/iir/iir.c
sys/dev/isci/isci_controller.c
sys/dev/iscsi_initiator/isc_cam.c
sys/dev/isp/isp_freebsd.c
sys/dev/mfi/mfi_cam.c
sys/dev/mly/mly.c
sys/dev/mpr/mpr_sas.c
sys/dev/mps/mps_sas.c
sys/dev/mpt/mpt_cam.c
sys/dev/mrsas/mrsas_cam.c
sys/dev/mvs/mvs.c
sys/dev/ncr/ncr.c
sys/dev/pms/freebsd/driver/ini/src/agtiapi.c
sys/dev/ppbus/vpo.c
sys/dev/siis/siis.c
sys/dev/sym/sym_hipd.c
sys/dev/trm/trm.c
sys/dev/twa/tw_osl_cam.c
sys/dev/tws/tws_cam.c
sys/dev/virtio/scsi/virtio_scsi.c
sys/powerpc/ps3/ps3cdrom.c
sys/powerpc/pseries/phyp_vscsi.c