Commit b704f70c authored by Alan Stern's avatar Alan Stern Committed by James Bottomley

SCSI: fix bug in scsi_dev_info_list matching

The "compatible" matching algorithm used for looking up old-style
blacklist entries in a scsi_dev_info_list is buggy.  The core of the
algorithm looks like this:

		if (memcmp(devinfo->vendor, vendor,
			    min(max, strlen(devinfo->vendor))))
			/* not a match */

where max is the length of the device's vendor string after leading
spaces have been removed but trailing spaces have not.  Because of the
min() computation, either entry could be a proper substring of the
other and the code would still think that they match.

In the case originally reported, the device's vendor and product
strings were "Inateck " and "                ".  These matched against
the following entry in the global device list:

	{"", "Scanner", "1.80", BLIST_NOLUN}

because "" is a substring of "Inateck " and "" (the result of removing
leading spaces from the device's product string) is a substring of
"Scanner".  The mistaken match prevented the system from scanning and
finding the device's second Logical Unit.

This patch fixes the problem by making two changes.  First, the code
for leading-space removal is hoisted out of the loop.  (This means it
will sometimes run unnecessarily, but since a large percentage of all
lookups involve the "compatible" entries in global device list, this
should be an overall improvement.)  Second and more importantly, the
patch removes trailing spaces and adds a check to verify that the two
resulting strings are exactly the same length.  This prevents matches
where one entry is a proper substring of the other.
Signed-off-by: default avatarAlan Stern <stern@rowland.harvard.edu>
Reported-by: default avatarGiulio Bernardi <ugilio@gmail.com>
Tested-by: default avatarGiulio Bernardi <ugilio@gmail.com>
Signed-off-by: default avatarJames Bottomley <JBottomley@Odin.com>
parent c42b3654
......@@ -407,17 +407,14 @@ static struct scsi_dev_info_list *scsi_dev_info_list_find(const char *vendor,
struct scsi_dev_info_list *devinfo;
struct scsi_dev_info_list_table *devinfo_table =
scsi_devinfo_lookup_by_key(key);
size_t vmax, mmax;
const char *vskip, *mskip;
if (IS_ERR(devinfo_table))
return (struct scsi_dev_info_list *) devinfo_table;
list_for_each_entry(devinfo, &devinfo_table->scsi_dev_info_list,
dev_info_list) {
if (devinfo->compatible) {
/*
* Behave like the older version of get_device_flags.
*/
size_t max;
/* Prepare for "compatible" matches */
/*
* XXX why skip leading spaces? If an odd INQUIRY
* value, that should have been part of the
......@@ -426,32 +423,36 @@ static struct scsi_dev_info_list *scsi_dev_info_list_find(const char *vendor,
* here, and we don't know what device it is
* trying to work with, leave it as-is.
*/
max = 8; /* max length of vendor */
while ((max > 0) && *vendor == ' ') {
max--;
vendor++;
vmax = 8; /* max length of vendor */
vskip = vendor;
while (vmax > 0 && *vskip == ' ') {
vmax--;
vskip++;
}
/* Also skip trailing spaces */
while (vmax > 0 && vskip[vmax - 1] == ' ')
--vmax;
mmax = 16; /* max length of model */
mskip = model;
while (mmax > 0 && *mskip == ' ') {
mmax--;
mskip++;
}
while (mmax > 0 && mskip[mmax - 1] == ' ')
--mmax;
list_for_each_entry(devinfo, &devinfo_table->scsi_dev_info_list,
dev_info_list) {
if (devinfo->compatible) {
/*
* XXX removing the following strlen() would be
* good, using it means that for a an entry not in
* the list, we scan every byte of every vendor
* listed in scsi_static_device_list[], and never match
* a single one (and still have to compare at
* least the first byte of each vendor).
* Behave like the older version of get_device_flags.
*/
if (memcmp(devinfo->vendor, vendor,
min(max, strlen(devinfo->vendor))))
if (memcmp(devinfo->vendor, vskip, vmax) ||
devinfo->vendor[vmax])
continue;
/*
* Skip spaces again.
*/
max = 16; /* max length of model */
while ((max > 0) && *model == ' ') {
max--;
model++;
}
if (memcmp(devinfo->model, model,
min(max, strlen(devinfo->model))))
if (memcmp(devinfo->model, mskip, mmax) ||
devinfo->model[mmax])
continue;
return devinfo;
} else {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment