All of lore.kernel.org
 help / color / mirror / Atom feed
From: Justin Tee <justintee8345@gmail.com>
To: linux-scsi@vger.kernel.org
Cc: jsmart2021@gmail.com, justin.tee@broadcom.com,
	Justin Tee <justintee8345@gmail.com>
Subject: [PATCH 2/9] lpfc: Fix possible file string name overflow when updating firmware
Date: Tue, 31 Oct 2023 12:12:17 -0700	[thread overview]
Message-ID: <20231031191224.150862-3-justintee8345@gmail.com> (raw)
In-Reply-To: <20231031191224.150862-1-justintee8345@gmail.com>

Because file_name and phba->ModelName are both declared a size 80 bytes,
the extra ".grp" file extension could cause an overflow into file_name.

Define a ELX_FW_NAME_SIZE macro with value 84.  84 incorporates the 4 extra
characters from ".grp".  file_name is changed to be declared as a char and
initialized to zeros i.e. null chars.

Signed-off-by: Justin Tee <justin.tee@broadcom.com>
---
 drivers/scsi/lpfc/lpfc.h      | 1 +
 drivers/scsi/lpfc/lpfc_init.c | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
index af15f7a22d25..04d608ea9106 100644
--- a/drivers/scsi/lpfc/lpfc.h
+++ b/drivers/scsi/lpfc/lpfc.h
@@ -33,6 +33,7 @@
 struct lpfc_sli2_slim;
 
 #define ELX_MODEL_NAME_SIZE	80
+#define ELX_FW_NAME_SIZE	84
 
 #define LPFC_PCI_DEV_LP		0x1
 #define LPFC_PCI_DEV_OC		0x2
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 9e59c050103d..2c336953e56c 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -14725,7 +14725,7 @@ lpfc_write_firmware(const struct firmware *fw, void *context)
 int
 lpfc_sli4_request_firmware_update(struct lpfc_hba *phba, uint8_t fw_upgrade)
 {
-	uint8_t file_name[ELX_MODEL_NAME_SIZE];
+	char file_name[ELX_FW_NAME_SIZE] = {0};
 	int ret;
 	const struct firmware *fw;
 
@@ -14734,7 +14734,7 @@ lpfc_sli4_request_firmware_update(struct lpfc_hba *phba, uint8_t fw_upgrade)
 	    LPFC_SLI_INTF_IF_TYPE_2)
 		return -EPERM;
 
-	snprintf(file_name, ELX_MODEL_NAME_SIZE, "%s.grp", phba->ModelName);
+	scnprintf(file_name, sizeof(file_name), "%s.grp", phba->ModelName);
 
 	if (fw_upgrade == INT_FW_UPGRADE) {
 		ret = request_firmware_nowait(THIS_MODULE, FW_ACTION_UEVENT,
-- 
2.38.0


  parent reply	other threads:[~2023-10-31 18:59 UTC|newest]

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-10-31 19:12 [PATCH 0/9] lpfc: Update lpfc to revision 14.2.0.16 Justin Tee
2023-10-31 19:12 ` [PATCH 1/9] lpfc: Correct maximum PCI function value for RAS fw logging Justin Tee
2023-10-31 19:12 ` Justin Tee [this message]
2023-10-31 19:12 ` [PATCH 3/9] lpfc: Fix list_entry null check warning in lpfc_cmpl_els_plogi Justin Tee
2023-10-31 19:12 ` [PATCH 4/9] lpfc: Eliminate unnecessary relocking in lpfc_check_nlp_post_devloss Justin Tee
2023-10-31 19:12 ` [PATCH 5/9] lpfc: Return early in lpfc_poll_eratt when the driver is unloading Justin Tee
2023-10-31 19:12 ` [PATCH 6/9] lpfc: Refactor and clean up mailbox command memory free Justin Tee
2023-10-31 19:12 ` [PATCH 7/9] lpfc: Enhance driver logging for selected discovery events Justin Tee
2023-10-31 19:12 ` [PATCH 8/9] lpfc: Update lpfc version to 14.2.0.16 Justin Tee
2023-10-31 19:12 ` [PATCH 9/9] lpfc: Copyright updates for 14.2.0.16 patches Justin Tee
2023-11-02 15:56 ` [PATCH 0/9] lpfc: Update lpfc to revision 14.2.0.16 Himanshu Madhani
2023-11-25  2:54 ` Martin K. Petersen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20231031191224.150862-3-justintee8345@gmail.com \
    --to=justintee8345@gmail.com \
    --cc=jsmart2021@gmail.com \
    --cc=justin.tee@broadcom.com \
    --cc=linux-scsi@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.