From patchwork Thu Nov 29 01:01:54 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Disseldorp X-Patchwork-Id: 10703747 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id DDCB5109C for ; Thu, 29 Nov 2018 01:02:09 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D26852E1A0 for ; Thu, 29 Nov 2018 01:02:09 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id C54922E1B1; Thu, 29 Nov 2018 01:02:09 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 3BEC22E1A0 for ; Thu, 29 Nov 2018 01:02:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726825AbeK2MFk (ORCPT ); Thu, 29 Nov 2018 07:05:40 -0500 Received: from mx2.suse.de ([195.135.220.15]:39844 "EHLO mx1.suse.de" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1726297AbeK2MFj (ORCPT ); Thu, 29 Nov 2018 07:05:39 -0500 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.220.254]) by mx1.suse.de (Postfix) with ESMTP id 38E33AF5D; Thu, 29 Nov 2018 01:02:06 +0000 (UTC) From: David Disseldorp To: target-devel@vger.kernel.org Cc: hare@suse.com, lduncan@suse.com, cvubrugier@fastmail.fm, Mike Christie , martin.petersen@oracle.com, linux-scsi@vger.kernel.org, David Disseldorp Subject: [PATCH v4 4/7] target: consistently null-terminate t10_wwn.revision Date: Thu, 29 Nov 2018 02:01:54 +0100 Message-Id: <20181129010157.12687-5-ddiss@suse.de> X-Mailer: git-send-email 2.13.7 In-Reply-To: <20181129010157.12687-1-ddiss@suse.de> References: <20181129010157.12687-1-ddiss@suse.de> Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The pscsi_set_inquiry_info() codepath doesn't currently explicitly null-terminate t10_wwn.revision. Add an extra byte to the t10_wwn.model buffer and perform null string termination in all cases. Signed-off-by: David Disseldorp Reviewed-by: Bryant G. Ly bly@catalogicsoftware.com Reviewed-by: Lee Duncan --- drivers/target/target_core_device.c | 6 ++++-- drivers/target/target_core_pscsi.c | 4 +++- drivers/target/target_core_spc.c | 5 +++-- drivers/target/target_core_stat.c | 4 ++-- include/target/target_core_base.h | 3 ++- 5 files changed, 14 insertions(+), 8 deletions(-) diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c index 0d7382efb2d4..b3d0bd1ab09f 100644 --- a/drivers/target/target_core_device.c +++ b/drivers/target/target_core_device.c @@ -741,7 +741,7 @@ static void scsi_dump_inquiry(struct se_device *dev) buf[i] = '\0'; pr_debug(" Model: %s\n", buf); - for (i = 0; i < 4; i++) + for (i = 0; i < INQUIRY_REVISION_LEN; i++) if (wwn->revision[i] >= 0x20) buf[i] = wwn->revision[i]; else @@ -1010,6 +1010,7 @@ int target_configure_device(struct se_device *dev) */ BUILD_BUG_ON(sizeof(dev->t10_wwn.vendor) != INQUIRY_VENDOR_LEN + 1); BUILD_BUG_ON(sizeof(dev->t10_wwn.model) != INQUIRY_MODEL_LEN + 1); + BUILD_BUG_ON(sizeof(dev->t10_wwn.revision) != INQUIRY_REVISION_LEN + 1); if (!(dev->transport->transport_flags & TRANSPORT_FLAG_PASSTHROUGH)) { strncpy(&dev->t10_wwn.vendor[0], "LIO-ORG", INQUIRY_VENDOR_LEN); dev->t10_wwn.vendor[INQUIRY_VENDOR_LEN] = '\0'; @@ -1017,7 +1018,8 @@ int target_configure_device(struct se_device *dev) dev->transport->inquiry_prod, INQUIRY_MODEL_LEN); dev->t10_wwn.model[INQUIRY_MODEL_LEN] = '\0'; strncpy(&dev->t10_wwn.revision[0], - dev->transport->inquiry_rev, 4); + dev->transport->inquiry_rev, INQUIRY_REVISION_LEN); + dev->t10_wwn.revision[INQUIRY_REVISION_LEN] = '\0'; } scsi_dump_inquiry(dev); diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c index 1633babc2d4e..5493f620b7f4 100644 --- a/drivers/target/target_core_pscsi.c +++ b/drivers/target/target_core_pscsi.c @@ -196,7 +196,9 @@ pscsi_set_inquiry_info(struct scsi_device *sdev, struct t10_wwn *wwn) BUILD_BUG_ON(sizeof(wwn->model) != INQUIRY_MODEL_LEN + 1); memcpy(&wwn->model[0], &buf[16], INQUIRY_MODEL_LEN); wwn->model[INQUIRY_MODEL_LEN] = '\0'; - memcpy(&wwn->revision[0], &buf[32], sizeof(wwn->revision)); + BUILD_BUG_ON(sizeof(wwn->revision) != INQUIRY_REVISION_LEN + 1); + memcpy(&wwn->revision[0], &buf[32], INQUIRY_REVISION_LEN); + wwn->revision[INQUIRY_REVISION_LEN] = '\0'; } static int diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c index 78eddee4b6e6..8ffe712cb44d 100644 --- a/drivers/target/target_core_spc.c +++ b/drivers/target/target_core_spc.c @@ -113,12 +113,13 @@ spc_emulate_inquiry_std(struct se_cmd *cmd, unsigned char *buf) * unused bytes at the end of the field (i.e., highest offset) and the * unused bytes shall be filled with ASCII space characters (20h). */ - memset(&buf[8], 0x20, 8 + 16 + 4); + memset(&buf[8], 0x20, + INQUIRY_VENDOR_LEN + INQUIRY_MODEL_LEN + INQUIRY_REVISION_LEN); memcpy(&buf[8], "LIO-ORG", sizeof("LIO-ORG") - 1); memcpy(&buf[16], dev->t10_wwn.model, strnlen(dev->t10_wwn.model, INQUIRY_MODEL_LEN)); memcpy(&buf[32], dev->t10_wwn.revision, - strnlen(dev->t10_wwn.revision, 4)); + strnlen(dev->t10_wwn.revision, INQUIRY_REVISION_LEN)); buf[4] = 31; /* Set additional length to 31 */ return 0; diff --git a/drivers/target/target_core_stat.c b/drivers/target/target_core_stat.c index 9123c5137da5..e437ba494865 100644 --- a/drivers/target/target_core_stat.c +++ b/drivers/target/target_core_stat.c @@ -275,10 +275,10 @@ static ssize_t target_stat_lu_rev_show(struct config_item *item, char *page) { struct se_device *dev = to_stat_lu_dev(item); int i; - char str[sizeof(dev->t10_wwn.revision)+1]; + char str[INQUIRY_REVISION_LEN+1]; /* scsiLuRevisionId */ - for (i = 0; i < sizeof(dev->t10_wwn.revision); i++) + for (i = 0; i < INQUIRY_REVISION_LEN; i++) str[i] = ISPRINT(dev->t10_wwn.revision[i]) ? dev->t10_wwn.revision[i] : ' '; str[i] = '\0'; diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h index cfc279686cf4..497853a09fee 100644 --- a/include/target/target_core_base.h +++ b/include/target/target_core_base.h @@ -48,6 +48,7 @@ #define INQUIRY_VENDOR_LEN 8 #define INQUIRY_MODEL_LEN 16 +#define INQUIRY_REVISION_LEN 4 /* Attempts before moving from SHORT to LONG */ #define PYX_TRANSPORT_WINDOW_CLOSED_THRESHOLD 3 @@ -323,7 +324,7 @@ struct t10_wwn { */ char vendor[INQUIRY_VENDOR_LEN + 1]; char model[INQUIRY_MODEL_LEN + 1]; - char revision[4]; + char revision[INQUIRY_REVISION_LEN + 1]; char unit_serial[INQUIRY_VPD_SERIAL_LEN]; spinlock_t t10_vpd_lock; struct se_device *t10_dev;