From: Jim Meyering <jim@meyering.net>
To: linux-kernel@vger.kernel.org
Cc: Jim Meyering <meyering@redhat.com>,
Jing Huang <huangj@brocade.com>,
Krishna C Gudipati <kgudipat@brocade.com>,
"James E.J. Bottomley" <JBottomley@parallels.com>,
linux-scsi@vger.kernel.org
Subject: [PATCH] bfa: avoid buffer overrun for 12-byte model name
Date: Mon, 20 Aug 2012 18:55:23 +0200 [thread overview]
Message-ID: <1345481724-30108-5-git-send-email-jim@meyering.net> (raw)
In-Reply-To: <1345481724-30108-1-git-send-email-jim@meyering.net>
From: Jim Meyering <meyering@redhat.com>
we use strncpy to copy a model name of length up to 15 (16, if you count
the NUL), into a buffer of size 12 (BFA_FCS_PORT_SYMBNAME_MODEL_SZ).
However, strncpy does not always NUL-terminate, so whenever the original
model string has strlen >= 12, the following strncat reads beyond end
of the ->sym_name buffer as it attempts to find end of string.
bfa_fcs_fabric_psymb_init(struct bfa_fcs_fabric_s *fabric)
{
bfa_ioc_get_adapter_model(&fabric->fcs->bfa->ioc, model);
...
strncpy((char *)&port_cfg->sym_name, model,
BFA_FCS_PORT_SYMBNAME_MODEL_SZ);
strncat((char *)&port_cfg->sym_name, BFA_FCS_PORT_SYMBNAME_SEPARATOR,
sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR));
...
bfa_ioc_get_adapter_model(struct bfa_ioc_s *ioc, char *model)
{
struct bfi_ioc_attr_s *ioc_attr;
WARN_ON(!model);
memset((void *)model, 0, BFA_ADAPTER_MODEL_NAME_LEN);
BFA_ADAPTER_MODEL_NAME_LEN = 16
Signed-off-by: Jim Meyering <meyering@redhat.com>
---
drivers/scsi/bfa/bfa_fcs.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/scsi/bfa/bfa_fcs.c b/drivers/scsi/bfa/bfa_fcs.c
index eaac57e..3329493 100644
--- a/drivers/scsi/bfa/bfa_fcs.c
+++ b/drivers/scsi/bfa/bfa_fcs.c
@@ -713,6 +713,7 @@ bfa_fcs_fabric_psymb_init(struct bfa_fcs_fabric_s *fabric)
/* Model name/number */
strncpy((char *)&port_cfg->sym_name, model,
BFA_FCS_PORT_SYMBNAME_MODEL_SZ);
+ port_cfg->sym_name[BFA_FCS_PORT_SYMBNAME_MODEL_SZ - 1] = 0;
strncat((char *)&port_cfg->sym_name, BFA_FCS_PORT_SYMBNAME_SEPARATOR,
sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR));
--
1.7.12
next prev parent reply other threads:[~2012-08-20 17:29 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-08-20 16:55 a few strncpy-related patches Jim Meyering
2012-08-20 16:55 ` [PATCH] ACPI: remove unwarranted use of strncpy Jim Meyering
2012-08-20 16:55 ` [PATCH] fs/9p: avoid debug OOPS when reading a long symlink Jim Meyering
2012-08-21 7:20 ` [PATCHv2] " Jim Meyering
2012-08-20 16:55 ` [PATCH] kmemleak: avoid buffer overrun: NUL-terminate strncpy-copied command Jim Meyering
2012-08-24 10:27 ` Catalin Marinas
2012-08-24 11:23 ` Jim Meyering
2012-08-28 20:24 ` Dan Carpenter
2012-08-29 6:28 ` Jim Meyering
2012-08-29 15:56 ` Dan Carpenter
2012-08-20 16:55 ` Jim Meyering [this message]
2012-08-20 19:42 ` [PATCH] bfa: avoid buffer overrun for 12-byte model name Krishna Gudipati
2012-08-20 20:38 ` Jim Meyering
2012-10-14 7:53 ` Jim Meyering
2012-10-14 8:20 ` Jim Meyering
2012-12-24 7:43 ` Vijay Mohan Guvva
2012-08-20 16:55 ` [PATCH] cifs: remove misleading strncpy: each name has length < 16 Jim Meyering
[not found] ` <CAE2SPAbBmRov9qK2HiBQBQXaZpfJ8pmZJ-PL18FEyoZhzDza4A@mail.gmail.com>
2012-08-20 18:40 ` Jim Meyering
2012-08-20 18:41 ` Jim Meyering
2012-08-20 20:18 ` a few strncpy-related patches Andi Kleen
2012-08-20 20:47 ` Jim Meyering
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1345481724-30108-5-git-send-email-jim@meyering.net \
--to=jim@meyering.net \
--cc=JBottomley@parallels.com \
--cc=huangj@brocade.com \
--cc=kgudipat@brocade.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=meyering@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).