mirror of
https://github.com/freebsd/freebsd-src.git
synced 2026-10-28 11:25:21 +01:00
Ram Kishore Vegesna
039a8e11f8
Fix three unrelated problems found by security review of the driver.
ECD helper ioctl:
- OCS_ECD_HELPER_CFG_READ* and OCS_ECD_HELPER_CFG_WRITE* passed a user
supplied offset straight to pci_read_config() and pci_write_config().
Reject accesses that extend past PCIE_REGMAX, so that a wide access
starting in range cannot run past the end of config space.
- Use the real access width (1, 2 or 4 bytes) of the command for both
the BAR and the config space checks, rather than assuming 4 bytes, so
that narrow accesses at the very end of the BAR or config space are
not rejected while wider ones remain bounded.
PRLI:
- When a PRLI carries an FC-4 type other than the one the driver
supports, ocs_d_send_prli_rsp() sent an LS_RJT and started node
shutdown, but then fell through and sent a second response on the same
IO (another LS_RJT, or a PRLI LS_ACC when the initiator is accepted),
followed by a conflicting transition to __ocs_d_device_ready. The two
responses posted two WQEs for one IO and caused a double ocs_ref_put(),
a use after free of the ELS IO. Return after dispatching the LS_RJT so
that exactly one response is sent.
- __ocs_d_port_logged_in calls ocs_d_send_prli_rsp() without checking
the FC-4 type, so any port that has completed a PLOGI can trigger this
with a single PRLI, whether or not target mode is enabled.
Management:
- The active profile id is a uint32_t that is formatted as "0x%02x"
with sprintf() into a buffer of MAX_PROFILE_LENGTH (5) bytes, which
overflows for any id above 0xff. Size the buffer for the longest
possible string ("0x" plus 8 hex digits and the terminating NUL) and
use ocs_snprintf().
- Use ocs_snprintf() for nv_wwpn as well, as nv_wwnn already does.
MFC after: 1 week
Sponsored by: Broadcom
Reviewed by: ken