From: Justin Tee <justintee8345@gmail.com>
To: linux-scsi@vger.kernel.org
Cc: jsmart2021@gmail.com, justin.tee@broadcom.com,
Justin Tee <justintee8345@gmail.com>
Subject: [PATCH 2/9] lpfc: Fix possible file string name overflow when updating firmware
Date: Tue, 31 Oct 2023 12:12:17 -0700 [thread overview]
Message-ID: <20231031191224.150862-3-justintee8345@gmail.com> (raw)
In-Reply-To: <20231031191224.150862-1-justintee8345@gmail.com>
Because file_name and phba->ModelName are both declared a size 80 bytes,
the extra ".grp" file extension could cause an overflow into file_name.
Define a ELX_FW_NAME_SIZE macro with value 84. 84 incorporates the 4 extra
characters from ".grp". file_name is changed to be declared as a char and
initialized to zeros i.e. null chars.
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
---
drivers/scsi/lpfc/lpfc.h | 1 +
drivers/scsi/lpfc/lpfc_init.c | 4 ++--
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
index af15f7a22d25..04d608ea9106 100644
--- a/drivers/scsi/lpfc/lpfc.h
+++ b/drivers/scsi/lpfc/lpfc.h
@@ -33,6 +33,7 @@
struct lpfc_sli2_slim;
#define ELX_MODEL_NAME_SIZE 80
+#define ELX_FW_NAME_SIZE 84
#define LPFC_PCI_DEV_LP 0x1
#define LPFC_PCI_DEV_OC 0x2
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 9e59c050103d..2c336953e56c 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -14725,7 +14725,7 @@ lpfc_write_firmware(const struct firmware *fw, void *context)
int
lpfc_sli4_request_firmware_update(struct lpfc_hba *phba, uint8_t fw_upgrade)
{
- uint8_t file_name[ELX_MODEL_NAME_SIZE];
+ char file_name[ELX_FW_NAME_SIZE] = {0};
int ret;
const struct firmware *fw;
@@ -14734,7 +14734,7 @@ lpfc_sli4_request_firmware_update(struct lpfc_hba *phba, uint8_t fw_upgrade)
LPFC_SLI_INTF_IF_TYPE_2)
return -EPERM;
- snprintf(file_name, ELX_MODEL_NAME_SIZE, "%s.grp", phba->ModelName);
+ scnprintf(file_name, sizeof(file_name), "%s.grp", phba->ModelName);
if (fw_upgrade == INT_FW_UPGRADE) {
ret = request_firmware_nowait(THIS_MODULE, FW_ACTION_UEVENT,
--
2.38.0
next prev parent reply other threads:[~2023-10-31 18:59 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-10-31 19:12 [PATCH 0/9] lpfc: Update lpfc to revision 14.2.0.16 Justin Tee
2023-10-31 19:12 ` [PATCH 1/9] lpfc: Correct maximum PCI function value for RAS fw logging Justin Tee
2023-10-31 19:12 ` Justin Tee [this message]
2023-10-31 19:12 ` [PATCH 3/9] lpfc: Fix list_entry null check warning in lpfc_cmpl_els_plogi Justin Tee
2023-10-31 19:12 ` [PATCH 4/9] lpfc: Eliminate unnecessary relocking in lpfc_check_nlp_post_devloss Justin Tee
2023-10-31 19:12 ` [PATCH 5/9] lpfc: Return early in lpfc_poll_eratt when the driver is unloading Justin Tee
2023-10-31 19:12 ` [PATCH 6/9] lpfc: Refactor and clean up mailbox command memory free Justin Tee
2023-10-31 19:12 ` [PATCH 7/9] lpfc: Enhance driver logging for selected discovery events Justin Tee
2023-10-31 19:12 ` [PATCH 8/9] lpfc: Update lpfc version to 14.2.0.16 Justin Tee
2023-10-31 19:12 ` [PATCH 9/9] lpfc: Copyright updates for 14.2.0.16 patches Justin Tee
2023-11-02 15:56 ` [PATCH 0/9] lpfc: Update lpfc to revision 14.2.0.16 Himanshu Madhani
2023-11-25 2:54 ` Martin K. Petersen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20231031191224.150862-3-justintee8345@gmail.com \
--to=justintee8345@gmail.com \
--cc=jsmart2021@gmail.com \
--cc=justin.tee@broadcom.com \
--cc=linux-scsi@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox