Commit f8191d40 authored by James Smart's avatar James Smart Committed by Martin K. Petersen
Browse files

scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input 

Malformed user input to debugfs results in buffer overflow crashes.  Adapt
input string lengths to fit within internal buffers, leaving space for NULL
terminators.

Link: https://lore.kernel.org/r/20220701211425.2708-3-jsmart2021@gmail.com


Co-developed-by: default avatarJustin Tee <justin.tee@broadcom.com>
Signed-off-by: default avatarJustin Tee <justin.tee@broadcom.com>
Signed-off-by: default avatarJames Smart <jsmart2021@gmail.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 4ecc9b02

drivers/scsi/lpfc/lpfc_debugfs.c

+10 −10
Original line number Diff line number Diff line
@@ -2607,8 +2607,8 @@ lpfc_debugfs_multixripools_write(struct file *file, const char __user *buf, 
	struct lpfc_sli4_hdw_queue *qp;

	struct lpfc_multixri_pool *multixri_pool;



	if (nbytes > 64)

		nbytes = 64;

	if (nbytes > sizeof(mybuf) - 1)

		nbytes = sizeof(mybuf) - 1;



	memset(mybuf, 0, sizeof(mybuf));
@@ -2688,8 +2688,8 @@ lpfc_debugfs_nvmestat_write(struct file *file, const char __user *buf, 
	if (!phba->targetport)

		return -ENXIO;



	if (nbytes > 64)

		nbytes = 64;

	if (nbytes > sizeof(mybuf) - 1)

		nbytes = sizeof(mybuf) - 1;



	memset(mybuf, 0, sizeof(mybuf));
@@ -2826,8 +2826,8 @@ lpfc_debugfs_ioktime_write(struct file *file, const char __user *buf, 
	char mybuf[64];

	char *pbuf;



	if (nbytes > 64)

		nbytes = 64;

	if (nbytes > sizeof(mybuf) - 1)

		nbytes = sizeof(mybuf) - 1;



	memset(mybuf, 0, sizeof(mybuf));
@@ -2954,8 +2954,8 @@ lpfc_debugfs_nvmeio_trc_write(struct file *file, const char __user *buf, 
	char mybuf[64];

	char *pbuf;



	if (nbytes > 63)

		nbytes = 63;

	if (nbytes > sizeof(mybuf) - 1)

		nbytes = sizeof(mybuf) - 1;



	memset(mybuf, 0, sizeof(mybuf));
@@ -3060,8 +3060,8 @@ lpfc_debugfs_hdwqstat_write(struct file *file, const char __user *buf, 
	char *pbuf;

	int i;



	if (nbytes > 64)

		nbytes = 64;

	if (nbytes > sizeof(mybuf) - 1)

		nbytes = sizeof(mybuf) - 1;



	memset(mybuf, 0, sizeof(mybuf));