]> CyberLeo.Net >> Repos - FreeBSD/stable/10.git/commit
MFC r311305 (by asomers):
authormav <mav@ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f>
Thu, 23 Mar 2017 06:41:13 +0000 (06:41 +0000)
committermav <mav@ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f>
Thu, 23 Mar 2017 06:41:13 +0000 (06:41 +0000)
commit22067b37fabf1aec1d85f54c7312981b4f20debe
tree15e02dbc1c5e7eb7fccbc68b409f233bf9fa9be0
parentafcbe9dade65ed9127ee9be5bf2adc3639ad907c
MFC r311305 (by asomers):
Always null-terminate ccb_pathinq.(sim_vid|hba_vid|dev_name)

The sim_vid, hba_vid, and dev_name fields of struct ccb_pathinq are
fixed-length strings. AFAICT the only place they're read is in
sbin/camcontrol/camcontrol.c, which assumes they'll be null-terminated.
However, the kernel doesn't null-terminate them. A bunch of copy-pasted code
uses strncpy to write them, and doesn't guarantee null-termination. For at
least 4 drivers (mpr, mps, ciss, and hyperv), the hba_vid field actually
overflows. You can see the result by doing "camcontrol negotiate da0 -v".

This change null-terminates those fields everywhere they're set in the
kernel. It also shortens a few strings to ensure they'll fit within the
16-character field.

PR:             215474
Reported by:    Coverity
CID:            1009997 1010000 1010001 1010002 1010003 1010004 1010005
CID:            1331519 1010006 1215097 1010007 1288967 1010008 1306000
CID:            1211924 1010009 1010010 1010011 1010012 1010013 1010014
CID:            1147190 1010017 1010016 1010018 1216435 1010020 1010021
CID:            1010022 1009666 1018185 1010023 1010025 1010026 1010027
CID:            1010028 1010029 1010030 1010031 1010033 1018186 1018187
CID:            1010035 1010036 1010042 1010041 1010040 1010039

git-svn-id: svn://svn.freebsd.org/base/stable/10@315813 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f
50 files changed:
sys/cam/cam_xpt.c
sys/cam/ctl/ctl_frontend_cam_sim.c
sys/cam/scsi/scsi_low.c
sys/dev/aac/aac_cam.c
sys/dev/aacraid/aacraid_cam.c
sys/dev/advansys/advansys.c
sys/dev/advansys/adwcam.c
sys/dev/aha/aha.c
sys/dev/ahb/ahb.c
sys/dev/ahci/ahci.c
sys/dev/ahci/ahciem.c
sys/dev/aic/aic.c
sys/dev/aic7xxx/aic79xx_osm.c
sys/dev/aic7xxx/aic7xxx_osm.c
sys/dev/amr/amr_cam.c
sys/dev/arcmsr/arcmsr.c
sys/dev/ata/ata-all.c
sys/dev/buslogic/bt.c
sys/dev/ciss/ciss.c
sys/dev/dpt/dpt_scsi.c
sys/dev/esp/ncr53c9x.c
sys/dev/firewire/sbp.c
sys/dev/firewire/sbp_targ.c
sys/dev/hpt27xx/hpt27xx_osm_bsd.c
sys/dev/hptiop/hptiop.c
sys/dev/hptmv/entry.c
sys/dev/hptnr/hptnr_osm_bsd.c
sys/dev/hptrr/hptrr_osm_bsd.c
sys/dev/hyperv/storvsc/hv_storvsc_drv_freebsd.c
sys/dev/iir/iir.c
sys/dev/isci/isci_controller.c
sys/dev/iscsi_initiator/isc_cam.c
sys/dev/isp/isp_freebsd.c
sys/dev/mfi/mfi_cam.c
sys/dev/mly/mly.c
sys/dev/mpr/mpr_sas.c
sys/dev/mps/mps_sas.c
sys/dev/mpt/mpt_cam.c
sys/dev/mrsas/mrsas_cam.c
sys/dev/mvs/mvs.c
sys/dev/pms/freebsd/driver/ini/src/agtiapi.c
sys/dev/ppbus/vpo.c
sys/dev/siis/siis.c
sys/dev/sym/sym_hipd.c
sys/dev/trm/trm.c
sys/dev/twa/tw_osl_cam.c
sys/dev/tws/tws_cam.c
sys/dev/virtio/scsi/virtio_scsi.c
sys/powerpc/ps3/ps3cdrom.c
sys/powerpc/pseries/phyp_vscsi.c