From nobody Wed Dec 08 04:07:07 2021 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 8019118C8575; Wed, 8 Dec 2021 04:07:08 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4J83XC6zVSz3Gsy; Wed, 8 Dec 2021 04:07:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id CCA7A48A7; Wed, 8 Dec 2021 04:07:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 1B8477mN038105; Wed, 8 Dec 2021 04:07:07 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 1B8477lj038104; Wed, 8 Dec 2021 04:07:07 GMT (envelope-from git) Date: Wed, 8 Dec 2021 04:07:07 GMT Message-Id: <202112080407.1B8477lj038104@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Alexander Motin Subject: git: 5d8bf1ffbac5 - stable/13 - mpsutil: Fix data truncation by too short buffers. List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: mav X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: 5d8bf1ffbac552338eb6fc542a05b0bff61bbcbf Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1638936428; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=d1vckg0CKYDHWYZyvENf9MSvkeXT4lDUgDDz2vAQtNM=; b=g+AxG1iTTe8VKzbqd56U5UJ8BPSmRMW6Yjva4W2p3U9Pa4pKNXdlB8uY43cyWXrGsBEBog nIzd9vl89vl4/giMUQDoO9RtrfXSnpNqE5h9rxXbM3w/2MEfbiCdmZ7/IvgGuLEHkZnLKW G1V3lRcx2XimM7ANNMAmKrTIsypfwZnM1+F57dW74ojCh3HRvZtgXyJ4W/eNIa+aLQCrI5 XSq3hGFxeYzIBctwaT8gRu16pUaBdGJlrRoC1NWRjx6rSIaW0cgmcecQXiiUoB43n2HhSO 8P8E3iqUF4c84HAFjnH/lu5sA/yUJ5VZt7MOF157hF4U5DfV6qMGlEKRBxPQ5w== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1638936428; a=rsa-sha256; cv=none; b=YMMV98u10fngigDAM+G9Y8Qk1mxspDl6Oc6F3XDyV6uu7knAT1rNxrBPdKMyshz8K+HJ0D dUD7mqOE2tjq3wrwyODfjxU5ro50lq5zhpv1FTgzID/OY+nAfLVHOC6LnAC6RLXr6xbx8w xxqjjUE7E4GHFfkrq+ivESD5zEdGcqCVhS2jNhO9x3XPlSzS5WNrbFebRm0n2XH0p/Qllz yQiR1pegD6mE3NHc+9ziB4i0L+CnX7PPigdRDDEnrjkcohP50I7gEldFTFUWoOAwiw8ACl 4g6TkyM6Z5B5/2e8KXXVLRfdq1x0de6knOZgCejy58SWeGUCq5weLkl/F3Pkrw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch stable/13 has been updated by mav: URL: https://cgit.FreeBSD.org/src/commit/?id=5d8bf1ffbac552338eb6fc542a05b0bff61bbcbf commit 5d8bf1ffbac552338eb6fc542a05b0bff61bbcbf Author: Alexander Motin AuthorDate: 2021-11-30 01:14:13 +0000 Commit: Alexander Motin CommitDate: 2021-12-08 04:07:01 +0000 mpsutil: Fix data truncation by too short buffers. Length of some string buffers was insufficient for cases of more that 99 targets per HBA or slots per enclosure. Some others are tuned just for better alignment. While there also fix output formatting issues. MFC after: 1 week Sponsored by: iXsystems, Inc. (cherry picked from commit f5b0083302edcf421265530cc01dd87c06b23af1) --- usr.sbin/mpsutil/mps_show.c | 51 +++++++++++++++++++++++---------------------- 1 file changed, 26 insertions(+), 25 deletions(-) diff --git a/usr.sbin/mpsutil/mps_show.c b/usr.sbin/mpsutil/mps_show.c index 7c2596497818..d293003fc67f 100644 --- a/usr.sbin/mpsutil/mps_show.c +++ b/usr.sbin/mpsutil/mps_show.c @@ -74,7 +74,7 @@ show_adapter(int ac, char **av) MPI2_IOC_FACTS_REPLY *facts; U16 IOCStatus; char *speed, *minspeed, *maxspeed, *isdisabled, *type; - char devhandle[5], ctrlhandle[5]; + char devhandle[8], ctrlhandle[8]; int error, fd, v, i; if (ac != 1) { @@ -210,13 +210,14 @@ show_adapter(int ac, char **av) type = get_device_type(le32toh(phy0->ControllerPhyDeviceInfo)); if (le16toh(phy0->AttachedDevHandle) != 0) { - snprintf(devhandle, 5, "%04x", le16toh(phy0->AttachedDevHandle)); - snprintf(ctrlhandle, 5, "%04x", + snprintf(devhandle, sizeof(devhandle), "%04x", + le16toh(phy0->AttachedDevHandle)); + snprintf(ctrlhandle, sizeof(ctrlhandle), "%04x", le16toh(phy0->ControllerDevHandle)); speed = get_device_speed(phy0->NegotiatedLinkRate); } else { - snprintf(devhandle, 5, " "); - snprintf(ctrlhandle, 5, " "); + snprintf(devhandle, sizeof(devhandle), " "); + snprintf(ctrlhandle, sizeof(ctrlhandle), " "); speed = " "; } printf("%-8d%-12s%-11s%-10s%-8s%-7s%-7s%s\n", @@ -516,7 +517,7 @@ show_devices(int ac, char **av) MPI2_CONFIG_PAGE_SAS_DEV_0 *device; MPI2_CONFIG_PAGE_EXPANDER_1 *exp1; uint16_t IOCStatus, handle, bus, target; - char *type, *speed, enchandle[5], slot[3], bt[8]; + char *type, *speed, enchandle[8], slot[8], bt[16]; char buf[256]; int fd, error, nphys; @@ -605,11 +606,11 @@ show_devices(int ac, char **av) speed = " "; if (device->EnclosureHandle != 0) { - snprintf(enchandle, 5, "%04x", le16toh(device->EnclosureHandle)); - snprintf(slot, 3, "%02d", le16toh(device->Slot)); + snprintf(enchandle, sizeof(enchandle), "%04x", le16toh(device->EnclosureHandle)); + snprintf(slot, sizeof(slot), "%02d", le16toh(device->Slot)); } else { - snprintf(enchandle, 5, " "); - snprintf(slot, 3, " "); + snprintf(enchandle, sizeof(enchandle), " "); + snprintf(slot, sizeof(slot), " "); } printf("%-10s", bt); snprintf(buf, sizeof(buf), "%08x%08x", le32toh(device->SASAddress.High), @@ -634,7 +635,7 @@ static int show_enclosures(int ac, char **av) { MPI2_CONFIG_PAGE_SAS_ENCLOSURE_0 *enc; - char *type, sepstr[5]; + char *type, sepstr[8]; uint16_t IOCStatus, handle; int fd, error, issep; @@ -663,9 +664,9 @@ show_enclosures(int ac, char **av) } type = get_enc_type(le16toh(enc->Flags), &issep); if (issep == 0) - snprintf(sepstr, 5, " "); + snprintf(sepstr, sizeof(sepstr), " "); else - snprintf(sepstr, 5, "%04x", le16toh(enc->SEPDevHandle)); + snprintf(sepstr, sizeof(sepstr), "%04x", le16toh(enc->SEPDevHandle)); printf(" %.2d %08x%08x %s %04x %s\n", le16toh(enc->NumSlots), le32toh(enc->EnclosureLogicalID.High), le32toh(enc->EnclosureLogicalID.Low), sepstr, le16toh(enc->EnclosureHandle), @@ -685,7 +686,7 @@ show_expanders(int ac, char **av) MPI2_CONFIG_PAGE_EXPANDER_0 *exp0; MPI2_CONFIG_PAGE_EXPANDER_1 *exp1; uint16_t IOCStatus, handle; - char enchandle[5], parent[5], rphy[3], rhandle[5]; + char enchandle[8], parent[8], rphy[4], rhandle[8]; char *speed, *min, *max, *type; int fd, error, nphys, i; @@ -717,19 +718,19 @@ show_expanders(int ac, char **av) handle = le16toh(exp0->DevHandle); if (exp0->EnclosureHandle == 0x00) - snprintf(enchandle, 5, " "); + snprintf(enchandle, sizeof(enchandle), " "); else - snprintf(enchandle, 5, "%04d", le16toh(exp0->EnclosureHandle)); + snprintf(enchandle, sizeof(enchandle), "%04d", le16toh(exp0->EnclosureHandle)); if (exp0->ParentDevHandle == 0x0) - snprintf(parent, 5, " "); + snprintf(parent, sizeof(parent), " "); else - snprintf(parent, 5, "%04x", le16toh(exp0->ParentDevHandle)); + snprintf(parent, sizeof(parent), "%04x", le16toh(exp0->ParentDevHandle)); printf(" %02d %08x%08x %04x %s %s %d\n", exp0->NumPhys, le32toh(exp0->SASAddress.High), le32toh(exp0->SASAddress.Low), le16toh(exp0->DevHandle), parent, enchandle, exp0->SASLevel); printf("\n"); - printf(" Phy RemotePhy DevHandle Speed Min Max Device\n"); + printf(" Phy RemotePhy DevHandle Speed Min Max Device\n"); for (i = 0; i < nphys; i++) { exp1 = mps_read_extended_config_page(fd, MPI2_CONFIG_EXTPAGETYPE_SAS_EXPANDER, @@ -745,20 +746,20 @@ show_expanders(int ac, char **av) } type = get_device_type(le32toh(exp1->AttachedDeviceInfo)); if ((le32toh(exp1->AttachedDeviceInfo) &0x7) == 0) { - speed = " "; - snprintf(rphy, 3, " "); - snprintf(rhandle, 5, " "); + speed = " "; + snprintf(rphy, sizeof(rphy), " "); + snprintf(rhandle, sizeof(rhandle), " "); } else { speed = get_device_speed( exp1->NegotiatedLinkRate); - snprintf(rphy, 3, "%02d", + snprintf(rphy, sizeof(rphy), "%02d", exp1->AttachedPhyIdentifier); - snprintf(rhandle, 5, "%04x", + snprintf(rhandle, sizeof(rhandle), "%04x", le16toh(exp1->AttachedDevHandle)); } min = get_device_speed(exp1->HwLinkRate); max = get_device_speed(exp1->HwLinkRate >> 4); - printf(" %02d %s %s %s %s %s %s\n", exp1->Phy, rphy, rhandle, speed, min, max, type); + printf(" %02d %s %s %s %s %s %s\n", exp1->Phy, rphy, rhandle, speed, min, max, type); free(exp1); }