From nobody Tue Jan 02 00:37:29 2024 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4T3v7s6stHz55ym7; Tue, 2 Jan 2024 00:37:29 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4T3v7s4hSJz3Hy1; Tue, 2 Jan 2024 00:37:29 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1704155849; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=FncWmU1Gh1mj424q84b4JuoCaMJrnCAl1J/0OTxzOyc=; b=f+I/6hh79JYDgkZd6Xz3HqWyP391ojBmlqa+700vCPgggRTvd0VFYeHQYwK1ZBdBmqcIIw KhyguoQ+q9sKxz0vtNwrbatAXhEM9JVaxzU/ZJdiONqlYefsEZpMfKukbXirqwKhKXtM/p 0BSgBzlHynlbibBmY2kGboO0KKCNdYhK9OF+Iicw4K4vsL/jq5w5TOylU17AhMhG9eHLI2 d2n4jewE4wgULDrP3Fa97wGrImYZEwC3P5zjkyEPU6ExZOcQ6GTrE9X4N8xdG1Ge/2VNsG 1tAG5l6KwMjGcf78eYAbf3ey5DV/fwVnyEcbbQf+FKVhT/P7l6zFiCZ63dE7CQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1704155849; a=rsa-sha256; cv=none; b=wj7o9GiiO/yhmAE5INl3W9KMhqYL7ntNwGA59HqpobZf/RHcu8bP1vX7J6lstSeyOaOwX8 RfK1eGm82Hd2AfVi2EyE7G/tpPLLMWIevOCDttL+wr6+qIoM4OUuPAw9C+xhjBPQR+SjXq wGsjw1IEKOr6QRHPU+TSkMwUe+vPQL5cbR6GjnWTR3/is039TR4HC2IW2HMd2LkDli0P8b 2E8B05ttWxnMdDJnXafClXceg3Izm6yAeH0J2IBMcwxji6Chozg3KlYPlAwnpz9pvx1B8B Z7J9AeEkdslbVki3GadbvczGguGrUVy1c2RwLZkNiWaE8tNBMLq9K161oyOW6g== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1704155849; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=FncWmU1Gh1mj424q84b4JuoCaMJrnCAl1J/0OTxzOyc=; b=QC3PlCXXtPBxrjIY/s5jdbulx44+Ft4ttUdYRq1a7XhDOw6lIvKEJH5vWLAZor4atFniDQ UP1FwPPVc8FBmCqnKRjj1N2/DRF9aCRzRz8p2dcHwXzieQE7iR/fHuUf0FMHL8j4iav+R4 ecwLxh4LETP8FCZWdWk2sJ3yvbtEqs2A2vHn2tZsqw+htVNoz5n7LpF+nvJlTHcCBnfAhs SeAMqmi+MOVgPI+SLHO+HWme5A827Jf937/vbtUNJfzFcDHTTolexd2iz/4IL2abVLMBE9 lpVW74NGnC9f46L0arxCZoD5Z0OTOYMZRqjewB/00gg7gY2yPa2Jp64qPldujg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4T3v7s3m0NzfYM; Tue, 2 Jan 2024 00:37:29 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 4020bTmh085692; Tue, 2 Jan 2024 00:37:29 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 4020bTfn085689; Tue, 2 Jan 2024 00:37:29 GMT (envelope-from git) Date: Tue, 2 Jan 2024 00:37:29 GMT Message-Id: <202401020037.4020bTfn085689@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: d60d9b713a46 - stable/14 - mpr: Handle errors from copyout() in ioctl handlers List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: d60d9b713a46cb03aef2c1c3304aa29b7b033d83 Auto-Submitted: auto-generated The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=d60d9b713a46cb03aef2c1c3304aa29b7b033d83 commit d60d9b713a46cb03aef2c1c3304aa29b7b033d83 Author: Mark Johnston AuthorDate: 2023-12-26 01:42:49 +0000 Commit: Mark Johnston CommitDate: 2024-01-02 00:29:55 +0000 mpr: Handle errors from copyout() in ioctl handlers In preparation for adding a __result_use_check annotation to copyin() and related functions, start checking for errors from copyout() in the mpr(4) user command handler. This should make it easier to catch bugs. Reviewed by: imp, asomers MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D43177 (cherry picked from commit 68cc77a3b73ffda1e8ac891b9852faca833e11b7) --- sys/dev/mpr/mpr_user.c | 39 ++++++++++++++++++++++++++------------- 1 file changed, 26 insertions(+), 13 deletions(-) diff --git a/sys/dev/mpr/mpr_user.c b/sys/dev/mpr/mpr_user.c index f2847ae36d66..5245129ce8c1 100644 --- a/sys/dev/mpr/mpr_user.c +++ b/sys/dev/mpr/mpr_user.c @@ -714,9 +714,9 @@ mpr_user_command(struct mpr_softc *sc, struct mpr_usr_command *cmd) } mpr_unlock(sc); - copyout(rpl, cmd->rpl, sz); - if (buf != NULL) - copyout(buf, cmd->buf, cmd->len); + err = copyout(rpl, cmd->rpl, sz); + if (buf != NULL && err == 0) + err = copyout(buf, cmd->buf, cmd->len); mpr_dprint(sc, MPR_USER, "%s: reply size %d\n", __func__, sz); RetFreeUnlocked: @@ -848,7 +848,7 @@ mpr_user_pass_thru(struct mpr_softc *sc, mpr_pass_thru_t *data) /* * Copy the reply data and sense data to user space. */ - if ((cm != NULL) && (cm->cm_reply != NULL)) { + if (err == 0 && cm != NULL && cm->cm_reply != NULL) { rpl = (MPI2_DEFAULT_REPLY *)cm->cm_reply; sz = rpl->MsgLength * 4; @@ -858,7 +858,7 @@ mpr_user_pass_thru(struct mpr_softc *sc, mpr_pass_thru_t *data) __func__, data->ReplySize, sz); } mpr_unlock(sc); - copyout(cm->cm_reply, PTRIN(data->PtrReply), + err = copyout(cm->cm_reply, PTRIN(data->PtrReply), MIN(sz, data->ReplySize)); mpr_lock(sc); } @@ -1073,7 +1073,7 @@ mpr_user_pass_thru(struct mpr_softc *sc, mpr_pass_thru_t *data) /* * Copy the reply data and sense data to user space. */ - if (cm->cm_reply != NULL) { + if (err == 0 && cm->cm_reply != NULL) { rpl = (MPI2_DEFAULT_REPLY *)cm->cm_reply; sz = rpl->MsgLength * 4; @@ -1083,12 +1083,16 @@ mpr_user_pass_thru(struct mpr_softc *sc, mpr_pass_thru_t *data) data->ReplySize, sz); } mpr_unlock(sc); - copyout(cm->cm_reply, PTRIN(data->PtrReply), + err = copyout(cm->cm_reply, PTRIN(data->PtrReply), MIN(sz, data->ReplySize)); + if (err != 0) + mpr_dprint(sc, MPR_FAULT, "%s: failed to copy " + "IOCTL data to user space\n", __func__); mpr_lock(sc); - if ((function == MPI2_FUNCTION_SCSI_IO_REQUEST) || - (function == MPI2_FUNCTION_RAID_SCSI_IO_PASSTHROUGH)) { + if (err == 0 && + (function == MPI2_FUNCTION_SCSI_IO_REQUEST || + function == MPI2_FUNCTION_RAID_SCSI_IO_PASSTHROUGH)) { if (((MPI2_SCSI_IO_REPLY *)rpl)->SCSIState & MPI2_SCSI_STATE_AUTOSENSE_VALID) { sense_len = @@ -1096,8 +1100,13 @@ mpr_user_pass_thru(struct mpr_softc *sc, mpr_pass_thru_t *data) SenseCount)), sizeof(struct scsi_sense_data)); mpr_unlock(sc); - copyout(cm->cm_sense, (PTRIN(data->PtrReply + - sizeof(MPI2_SCSI_IO_REPLY))), sense_len); + err = copyout(cm->cm_sense, + PTRIN(data->PtrReply + + sizeof(MPI2_SCSI_IO_REPLY)), sense_len); + if (err != 0) + mpr_dprint(sc, MPR_FAULT, + "%s: failed to copy IOCTL data to " + "user space\n", __func__); mpr_lock(sc); } } @@ -1116,7 +1125,7 @@ mpr_user_pass_thru(struct mpr_softc *sc, mpr_pass_thru_t *data) * the same IOCTL structure and sense buffers can be used for * NVMe. */ - if (function == MPI2_FUNCTION_NVME_ENCAPSULATED) { + if (err == 0 && function == MPI2_FUNCTION_NVME_ENCAPSULATED) { if (cm->nvme_error_response == NULL) { mpr_dprint(sc, MPR_INFO, "NVMe Error Response " "buffer is NULL. Response data will not be " @@ -1130,9 +1139,13 @@ mpr_user_pass_thru(struct mpr_softc *sc, mpr_pass_thru_t *data) sz = MIN(le32toh(nvme_error_reply->ErrorResponseCount), NVME_ERROR_RESPONSE_SIZE); mpr_unlock(sc); - copyout(cm->cm_sense, + err = copyout(cm->cm_sense, (PTRIN(data->PtrReply + sizeof(MPI2_SCSI_IO_REPLY))), sz); + if (err != 0) + mpr_dprint(sc, MPR_FAULT, + "%s: failed to copy IOCTL data to " + "user space\n", __func__); mpr_lock(sc); } }