lkml.org 
[lkml]   [2018]   [May]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 107/165] scsi: qedi: Fix truncation of CHAP name and secret
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Andrew Vasquez <andrew.vasquez@cavium.com>

    [ Upstream commit 1683ce57f568c7c92d53e9234624a53554a29cd5 ]

    The data in NVRAM is not guaranteed to be NUL terminated. Since
    snprintf expects byte-stream to accommodate null byte, the CHAP secret
    is truncated. Use sprintf instead of snprintf to fix the truncation of
    CHAP name and secret.

    Signed-off-by: Andrew Vasquez <andrew.vasquez@cavium.com>
    Signed-off-by: Nilesh Javali <nilesh.javali@cavium.com>
    Reviewed-by: Bart Van Assche <bart.vanassche@wdc.com>
    Acked-by: Chris Leech <cleech@redhat.com>
    Acked-by: Lee Duncan <lduncan@suse.com>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/scsi/qedi/qedi_main.c | 24 ++++++++++++------------
    1 file changed, 12 insertions(+), 12 deletions(-)

    --- a/drivers/scsi/qedi/qedi_main.c
    +++ b/drivers/scsi/qedi/qedi_main.c
    @@ -1840,8 +1840,8 @@ static ssize_t qedi_show_boot_ini_info(v

    switch (type) {
    case ISCSI_BOOT_INI_INITIATOR_NAME:
    - rc = snprintf(str, NVM_ISCSI_CFG_ISCSI_NAME_MAX_LEN, "%s\n",
    - initiator->initiator_name.byte);
    + rc = sprintf(str, "%.*s\n", NVM_ISCSI_CFG_ISCSI_NAME_MAX_LEN,
    + initiator->initiator_name.byte);
    break;
    default:
    rc = 0;
    @@ -1908,8 +1908,8 @@ qedi_show_boot_tgt_info(struct qedi_ctx

    switch (type) {
    case ISCSI_BOOT_TGT_NAME:
    - rc = snprintf(str, NVM_ISCSI_CFG_ISCSI_NAME_MAX_LEN, "%s\n",
    - block->target[idx].target_name.byte);
    + rc = sprintf(str, "%.*s\n", NVM_ISCSI_CFG_ISCSI_NAME_MAX_LEN,
    + block->target[idx].target_name.byte);
    break;
    case ISCSI_BOOT_TGT_IP_ADDR:
    if (ipv6_en)
    @@ -1930,20 +1930,20 @@ qedi_show_boot_tgt_info(struct qedi_ctx
    block->target[idx].lun.value[0]);
    break;
    case ISCSI_BOOT_TGT_CHAP_NAME:
    - rc = snprintf(str, NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN, "%s\n",
    - chap_name);
    + rc = sprintf(str, "%.*s\n", NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN,
    + chap_name);
    break;
    case ISCSI_BOOT_TGT_CHAP_SECRET:
    - rc = snprintf(str, NVM_ISCSI_CFG_CHAP_PWD_MAX_LEN, "%s\n",
    - chap_secret);
    + rc = sprintf(str, "%.*s\n", NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN,
    + chap_secret);
    break;
    case ISCSI_BOOT_TGT_REV_CHAP_NAME:
    - rc = snprintf(str, NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN, "%s\n",
    - mchap_name);
    + rc = sprintf(str, "%.*s\n", NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN,
    + mchap_name);
    break;
    case ISCSI_BOOT_TGT_REV_CHAP_SECRET:
    - rc = snprintf(str, NVM_ISCSI_CFG_CHAP_PWD_MAX_LEN, "%s\n",
    - mchap_secret);
    + rc = sprintf(str, "%.*s\n", NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN,
    + mchap_secret);
    break;
    case ISCSI_BOOT_TGT_FLAGS:
    rc = snprintf(str, 3, "%hhd\n", SYSFS_FLAG_FW_SEL_BOOT);

    \
     
     \ /
      Last update: 2018-05-24 12:59    [W:4.681 / U:1.076 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site