From nobody Tue Jan 02 00:37:16 2024 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4T3v7d14sRz55yny; Tue, 2 Jan 2024 00:37:17 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4T3v7c6q0Hz3HKk; Tue, 2 Jan 2024 00:37:16 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1704155837; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=pH+medsmpmeZgjGD6Phkxn6WcFzKQlIzIgEhkjtVpnI=; b=a6aOvHHkQWGZ7c2Z32sKM2txYlJx1PqsyB1S+BOPuydfYeluoH2pANXoQTHcQAfJTyERcF UpU0Tz46KQ1LXetwd1Y5+Bs7prKPVxv+ayzYaeXthlUBOI2im/697BkuHVrQodeep0KFjK qKXoH7PXH6SkKUfZKCpC6gwNE4WGAUcy1/YRRUFmafZOhFDsT3ocLocwtpGED31aeVP903 SoE3oUGRhPSR3rIxmSSpe3C70qfEZQQnvlxA9Xr4MjL7Y92pZKa2h3pf9zW/CtRGwpq1zz kwtCcxYg9ug3x16rEe3PJvr8XEcuhLpZLs9wOj7fagJC/6/GatkyB8CrM2xJTA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1704155837; a=rsa-sha256; cv=none; b=yafw8gshj6r+8snwQ0ua9BGY5x3+E/zGMuwj6MmNdMpEbRSeqqNqCq4xWp+jNcIGxvDHrh DD9u3M29e8YKVDVtmaChzCwcmtaDA6r9lHWNQilSUVDC8UtnSOpkvdzWKA1XIVzF5eZ1rZ qvQb5g7MTrTTbxizfTaJI/m8BI/J5x5VA9Q2xaIwHuDWtPqMFIdaiJSYkT1/BoSQPZaqbH pfGGB+ZAnHBnNhaFVqMMxBlwoqZFL2CtAMfiTYeAtQMmTJ5pDL3g8SVa7g0k5FhHQR0zju G39dJ7WdpdE5RMPz6ExkrzrrsA3lGFEgyFYKK6A+K1hwMzI/CHMgaM75KHi1cA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1704155837; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=pH+medsmpmeZgjGD6Phkxn6WcFzKQlIzIgEhkjtVpnI=; b=B/2d/U84xQeXqAH7+SKYM4u3d9BLGJQRSxhmLllcM9bDapEwjF9k+nRW7AHAGvnsJYzwu9 8hYi6nas6oBhLvYXKSLHBVlqSeflfhQ0x6vmjg719kgjG/j1axJUFPbPXjuW3cz/K8RrTT OXaA1qDcXIZnGrpEGbWTLnr5VzaqcCVWAWkq5QSyhCrT3aCJCUMHLRt1/tzkRKXibKfxXc c5BXRgZPMjMlGLqPovWuygfpgKYX0JaST0rEt9wgKWalYN9qRMa+DPD27FSmu4RuwB3uOU XfBPeCO7jZ1raG+Oaldf7wEVWZjQoKU22skEr+hqs0Rpm65+UhSGvAxAHAWG0A== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4T3v7c5w8GzfQC; Tue, 2 Jan 2024 00:37:16 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 4020bGKY085131; Tue, 2 Jan 2024 00:37:16 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 4020bGjR085128; Tue, 2 Jan 2024 00:37:16 GMT (envelope-from git) Date: Tue, 2 Jan 2024 00:37:16 GMT Message-Id: <202401020037.4020bGjR085128@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: d8fe1e4c5a9d - stable/14 - ocs: Check for copyin errors in the ioctl handler List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: d8fe1e4c5a9dd17d79635c5964b7fa68f1954bea Auto-Submitted: auto-generated The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=d8fe1e4c5a9dd17d79635c5964b7fa68f1954bea commit d8fe1e4c5a9dd17d79635c5964b7fa68f1954bea Author: Mark Johnston AuthorDate: 2023-12-26 01:38:57 +0000 Commit: Mark Johnston CommitDate: 2024-01-02 00:29:46 +0000 ocs: Check for copyin errors in the ioctl handler If copyin() fails, the driver will blindly proceed with whatever had been in the uninitialized DMA buffer. This is not what we want. Check for copyin failures. This is in preparation for annotating copyin() and related functions with __result_use_check. Reviewed by: ram MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D43097 (cherry picked from commit a01ff11cb73d7a1988f6241f63d141371ff23717) --- sys/dev/ocs_fc/ocs_ioctl.c | 24 ++++++++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) diff --git a/sys/dev/ocs_fc/ocs_ioctl.c b/sys/dev/ocs_fc/ocs_ioctl.c index 6021ddf5c0d6..71ba17d5f72a 100644 --- a/sys/dev/ocs_fc/ocs_ioctl.c +++ b/sys/dev/ocs_fc/ocs_ioctl.c @@ -86,6 +86,7 @@ static int ocs_process_sli_config (ocs_t *ocs, ocs_ioctl_elxu_mbox_t *mcmd, ocs_dma_t *dma) { sli4_cmd_sli_config_t *sli_config = (sli4_cmd_sli_config_t *)mcmd->payload; + int error; if (sli_config->emb) { sli4_req_hdr_t *req = (sli4_req_hdr_t *)sli_config->payload.embed; @@ -127,7 +128,13 @@ ocs_process_sli_config (ocs_t *ocs, ocs_ioctl_elxu_mbox_t *mcmd, ocs_dma_t *dma) wrobj->host_buffer_descriptor[0].u.data.buffer_address_high = ocs_addr32_hi(dma->phys); /* copy the data into the DMA buffer */ - copyin((void *)(uintptr_t)mcmd->in_addr, dma->virt, mcmd->in_bytes); + error = copyin((void *)(uintptr_t)mcmd->in_addr, dma->virt, mcmd->in_bytes); + if (error != 0) { + device_printf(ocs->dev, "%s: COMMON_WRITE_OBJECT - copyin failed: %d\n", + __func__, error); + ocs_dma_free(ocs, dma); + return error; + } } break; case SLI4_OPC_COMMON_DELETE_OBJECT: @@ -170,7 +177,13 @@ ocs_process_sli_config (ocs_t *ocs, ocs_ioctl_elxu_mbox_t *mcmd, ocs_dma_t *dma) return ENXIO; } - copyin((void *)(uintptr_t)mcmd->in_addr, dma->virt, mcmd->in_bytes); + error = copyin((void *)(uintptr_t)mcmd->in_addr, dma->virt, mcmd->in_bytes); + if (error != 0) { + device_printf(ocs->dev, "%s: non-embedded - copyin failed: %d\n", + __func__, error); + ocs_dma_free(ocs, dma); + return error; + } sli_config->payload.mem.address_low = ocs_addr32_lo(dma->phys); sli_config->payload.mem.address_high = ocs_addr32_hi(dma->phys); @@ -184,6 +197,9 @@ static int ocs_process_mbx_ioctl(ocs_t *ocs, ocs_ioctl_elxu_mbox_t *mcmd) { ocs_dma_t dma = { 0 }; + int error; + + error = 0; if ((ELXU_BSD_MAGIC != mcmd->magic) || (sizeof(ocs_ioctl_elxu_mbox_t) != mcmd->size)) { @@ -238,13 +254,13 @@ ocs_process_mbx_ioctl(ocs_t *ocs, ocs_ioctl_elxu_mbox_t *mcmd) if( SLI4_MBOX_COMMAND_SLI_CONFIG == ((sli4_mbox_command_header_t *)mcmd->payload)->command && mcmd->out_bytes && dma.virt) { - copyout(dma.virt, (void *)(uintptr_t)mcmd->out_addr, mcmd->out_bytes); + error = copyout(dma.virt, (void *)(uintptr_t)mcmd->out_addr, mcmd->out_bytes); } no_support: ocs_dma_free(ocs, &dma); - return 0; + return error; } /**