Commit f8191d40 authored by James Smart's avatar James Smart Committed by Martin K. Petersen

scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input

Malformed user input to debugfs results in buffer overflow crashes.  Adapt
input string lengths to fit within internal buffers, leaving space for NULL
terminators.

Link: https://lore.kernel.org/r/20220701211425.2708-3-jsmart2021@gmail.comCo-developed-by: default avatarJustin Tee <justin.tee@broadcom.com>
Signed-off-by: default avatarJustin Tee <justin.tee@broadcom.com>
Signed-off-by: default avatarJames Smart <jsmart2021@gmail.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 4ecc9b02
...@@ -2607,8 +2607,8 @@ lpfc_debugfs_multixripools_write(struct file *file, const char __user *buf, ...@@ -2607,8 +2607,8 @@ lpfc_debugfs_multixripools_write(struct file *file, const char __user *buf,
struct lpfc_sli4_hdw_queue *qp; struct lpfc_sli4_hdw_queue *qp;
struct lpfc_multixri_pool *multixri_pool; struct lpfc_multixri_pool *multixri_pool;
if (nbytes > 64) if (nbytes > sizeof(mybuf) - 1)
nbytes = 64; nbytes = sizeof(mybuf) - 1;
memset(mybuf, 0, sizeof(mybuf)); memset(mybuf, 0, sizeof(mybuf));
...@@ -2688,8 +2688,8 @@ lpfc_debugfs_nvmestat_write(struct file *file, const char __user *buf, ...@@ -2688,8 +2688,8 @@ lpfc_debugfs_nvmestat_write(struct file *file, const char __user *buf,
if (!phba->targetport) if (!phba->targetport)
return -ENXIO; return -ENXIO;
if (nbytes > 64) if (nbytes > sizeof(mybuf) - 1)
nbytes = 64; nbytes = sizeof(mybuf) - 1;
memset(mybuf, 0, sizeof(mybuf)); memset(mybuf, 0, sizeof(mybuf));
...@@ -2826,8 +2826,8 @@ lpfc_debugfs_ioktime_write(struct file *file, const char __user *buf, ...@@ -2826,8 +2826,8 @@ lpfc_debugfs_ioktime_write(struct file *file, const char __user *buf,
char mybuf[64]; char mybuf[64];
char *pbuf; char *pbuf;
if (nbytes > 64) if (nbytes > sizeof(mybuf) - 1)
nbytes = 64; nbytes = sizeof(mybuf) - 1;
memset(mybuf, 0, sizeof(mybuf)); memset(mybuf, 0, sizeof(mybuf));
...@@ -2954,8 +2954,8 @@ lpfc_debugfs_nvmeio_trc_write(struct file *file, const char __user *buf, ...@@ -2954,8 +2954,8 @@ lpfc_debugfs_nvmeio_trc_write(struct file *file, const char __user *buf,
char mybuf[64]; char mybuf[64];
char *pbuf; char *pbuf;
if (nbytes > 63) if (nbytes > sizeof(mybuf) - 1)
nbytes = 63; nbytes = sizeof(mybuf) - 1;
memset(mybuf, 0, sizeof(mybuf)); memset(mybuf, 0, sizeof(mybuf));
...@@ -3060,8 +3060,8 @@ lpfc_debugfs_hdwqstat_write(struct file *file, const char __user *buf, ...@@ -3060,8 +3060,8 @@ lpfc_debugfs_hdwqstat_write(struct file *file, const char __user *buf,
char *pbuf; char *pbuf;
int i; int i;
if (nbytes > 64) if (nbytes > sizeof(mybuf) - 1)
nbytes = 64; nbytes = sizeof(mybuf) - 1;
memset(mybuf, 0, sizeof(mybuf)); memset(mybuf, 0, sizeof(mybuf));
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment