kernel.git/drivers/scsi/bfa/bfad_debugfs.c, branch linux-4.19.y

scsi: bfa: Ensure the copied buf is NUL terminated

2024-06-16T11:23:28Z

[ Upstream commit 13d0cecb4626fae67c00c84d3c7851f6b62f7df3 ] Currently, we allocate a nbytes-sized kernel buffer and copy nbytes from userspace to that buffer. Later, we use sscanf on this buffer but we don't ensure that the string is terminated inside the buffer, this can lead to OOB read when using sscanf. Fix this issue by using memdup_user_nul instead of memdup_user. Fixes: 9f30b674759b ("bfa: replace 2 kzalloc/copy_from_user by memdup_user") Signed-off-by: Bui Quang Minh Link: https://lore.kernel.org/r/20240424-fix-oob-read-v2-3-f1f1b53a10f4@gmail.com Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin

scsi: bfa: Use zeroing allocator rather than allocator/memset

2018-01-04T06:12:32Z

Use vzalloc instead of vmalloc followed by memset 0. Generated-by: scripts/coccinelle/api/alloc/kzalloc-simple.cocci Suggested-by: Luis R. Rodriguez Signed-off-by: Himanshu Jha Acked-by: Anil Gurumurthy Signed-off-by: Martin K. Petersen

scsi: bfa: integer overflow in debugfs

2017-10-17T02:35:13Z

We could allocate less memory than intended because we do: bfad->regdata = kzalloc(len << 2, GFP_KERNEL); The shift can overflow leading to a crash. This is debugfs code so the impact is very small. I fixed the network version of this in March with commit 13e2d5187f6b ("bna: integer overflow bug in debugfs"). Fixes: ab2a9ba189e8 ("[SCSI] bfa: add debugfs support") Signed-off-by: Dan Carpenter Signed-off-by: Martin K. Petersen

bfa: File header and user visible string changes

2015-12-02T22:07:38Z

Signed-off-by: Sudarsana Kalluru Signed-off-by: Anil Gurumurthy Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen

bfa: Update copyright messages

2015-12-02T22:05:45Z

Signed-off-by: Sudarsana Kalluru Signed-off-by: Anil Gurumurthy Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen

bfa: replace 2 kzalloc/copy_from_user by memdup_user

2014-11-20T08:11:29Z

This patch also removes unnecessary printk(KERN_INFO Signed-off-by: Fabian Frederick Acked-by: Anil Gurumurthy Signed-off-by: Christoph Hellwig

bfa: switch to fixed_size_llseek()

2013-06-29T08:57:32Z

Signed-off-by: Al Viro

lseek(fd, n, SEEK_END) does not go to eof - n

2013-06-16T18:10:53Z

When you copy some code, you are supposed to read it. If nothing else, there's a chance to spot and fix an obvious bug instead of sharing it... X-Song: "I Got It From Agnes", by Tom Lehrer Signed-off-by: Al Viro [ Tom Lehrer? You're dating yourself, Al ] Signed-off-by: Linus Torvalds

Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6

2012-01-10T18:36:08Z

SCSI updates for post 3.2 merge window * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6: (67 commits) [SCSI] lpfc 8.3.28: Update driver version to 8.3.28 [SCSI] lpfc 8.3.28: Add Loopback support for SLI4 adapters [SCSI] lpfc 8.3.28: Critical Miscellaneous fixes [SCSI] Lpfc 8.3.28: FC and SCSI Discovery Fixes [SCSI] lpfc 8.3.28: Add support for ABTS failure handling [SCSI] lpfc 8.3.28: SLI fixes and added SLI4 support [SCSI] lpfc 8.3.28: Miscellaneous fixes in sysfs and mgmt interfaces [SCSI] mpt2sas: Removed redundant calling of _scsih_probe_devices() from _scsih_probe [SCSI] mac_scsi: Remove obsolete IRQ_FLG_* users [SCSI] qla4xxx: Update driver version to 5.02.00-k10 [SCSI] qla4xxx: check for FW alive before calling chip_reset [SCSI] qla4xxx: Fix qla4xxx_dump_buffer to dump buffer correctly [SCSI] qla4xxx: Fix the IDC locking mechanism [SCSI] qla4xxx: Wait for disable_acb before doing set_acb [SCSI] qla4xxx: Don't recover adapter if device state is FAILED [SCSI] qla4xxx: fix call trace on rmmod with ql4xdontresethba=1 [SCSI] qla4xxx: Fix CPU lockups when ql4xdontresethba set [SCSI] qla4xxx: Perform context resets in case of context failures. [SCSI] iscsi class: export pid of process that created [SCSI] mpt2sas: Remove unused duplicate diag_buffer_enable param ...

switch debugfs to umode_t

2012-01-04T03:54:56Z