From nobody Tue Nov 30 01:20:07 2021 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 5E88418B304C; Tue, 30 Nov 2021 01:20:08 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4J34CC5nxXz3RG9; Tue, 30 Nov 2021 01:20:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id A0D4E4FB8; Tue, 30 Nov 2021 01:20:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 1AU1K7ss031459; Tue, 30 Nov 2021 01:20:07 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 1AU1K7WD031456; Tue, 30 Nov 2021 01:20:07 GMT (envelope-from git) Date: Tue, 30 Nov 2021 01:20:07 GMT Message-Id: <202111300120.1AU1K7WD031456@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Alexander Motin Subject: git: f5b0083302ed - main - mpsutil: Fix data truncation by too short buffers. List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: mav X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: f5b0083302edcf421265530cc01dd87c06b23af1 Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1638235208; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=QURekTin+Kf884b/OG852ojBUhHSn7CACN+l3L/u0cg=; b=LR0/zG46W7aNsp4JN7CEj5s9Eog6FctfIPgq932yC00SMF65swBFFZmdQ3Ek64VfccbFyQ VDWO/cw+Dchk8oQ6RIMqPkyeh1DxquivpI2N73IkV21wfrdsAO8/+nl3c66nv4VN9dzmUI O/tT8Lo8dTIKvoIeGMGXDwrFVXew47x3D4fqKI1A8tywyA2TDhpA0TQkvpdeMFiorSnwj9 hBV3O0874ZDQ+QjQekAG2bF85NHDnDCvEyBKRi/+BdJoH3ZFyb/211UkhteXxCyEdwhxqZ /8MvHrtnVkQ4rtCem7zGS9WcoJHKsgVdhTEtmMEwsTs/RHHp7fPhwceR6r74TA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1638235208; a=rsa-sha256; cv=none; b=OosJnruFi6mqIpHuhA6SbCa+dNiCqpnGN7A0lZAIDgCJzjzxofxKhnmEHZAYo+jin33Bgg 8pA+VkYGfbcUK8qe2g7T8zNhphQqGy8G+IkmK7FB8/svLC0YA+4yt9OKojuVKbZbMnnTMp E3hj84nUbbM7NqtNWwGI0uBbqe6sTVR3Do9gYyD8ca30fq8EHVtNJWl1+sYQen3xlnOMOi JRpir3flCOefqC2hm5uJULlDQoG1pnImuQsUAnYCrAgjvYyEHtsAMwy74bpmlYX1b4B4FM U583hl3kVo8VIbqfPEB3fW19kHgGWRNDVXyhfUv20ct3RrxbkcM9yHkT/f9LDA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by mav: URL: https://cgit.FreeBSD.org/src/commit/?id=f5b0083302edcf421265530cc01dd87c06b23af1 commit f5b0083302edcf421265530cc01dd87c06b23af1 Author: Alexander Motin AuthorDate: 2021-11-30 01:14:13 +0000 Commit: Alexander Motin CommitDate: 2021-11-30 01:20:03 +0000 mpsutil: Fix data truncation by too short buffers. Length of some string buffers was insufficient for cases of more that 99 targets per HBA or slots per enclosure. Some others are tuned just for better alignment. While there also fix output formatting issues. MFC after: 1 week Sponsored by: iXsystems, Inc. --- usr.sbin/mpsutil/mps_show.c | 51 +++++++++++++++++++++++---------------------- 1 file changed, 26 insertions(+), 25 deletions(-) diff --git a/usr.sbin/mpsutil/mps_show.c b/usr.sbin/mpsutil/mps_show.c index 7c2596497818..d293003fc67f 100644 --- a/usr.sbin/mpsutil/mps_show.c +++ b/usr.sbin/mpsutil/mps_show.c @@ -74,7 +74,7 @@ show_adapter(int ac, char **av) MPI2_IOC_FACTS_REPLY *facts; U16 IOCStatus; char *speed, *minspeed, *maxspeed, *isdisabled, *type; - char devhandle[5], ctrlhandle[5]; + char devhandle[8], ctrlhandle[8]; int error, fd, v, i; if (ac != 1) { @@ -210,13 +210,14 @@ show_adapter(int ac, char **av) type = get_device_type(le32toh(phy0->ControllerPhyDeviceInfo)); if (le16toh(phy0->AttachedDevHandle) != 0) { - snprintf(devhandle, 5, "%04x", le16toh(phy0->AttachedDevHandle)); - snprintf(ctrlhandle, 5, "%04x", + snprintf(devhandle, sizeof(devhandle), "%04x", + le16toh(phy0->AttachedDevHandle)); + snprintf(ctrlhandle, sizeof(ctrlhandle), "%04x", le16toh(phy0->ControllerDevHandle)); speed = get_device_speed(phy0->NegotiatedLinkRate); } else { - snprintf(devhandle, 5, " "); - snprintf(ctrlhandle, 5, " "); + snprintf(devhandle, sizeof(devhandle), " "); + snprintf(ctrlhandle, sizeof(ctrlhandle), " "); speed = " "; } printf("%-8d%-12s%-11s%-10s%-8s%-7s%-7s%s\n", @@ -516,7 +517,7 @@ show_devices(int ac, char **av) MPI2_CONFIG_PAGE_SAS_DEV_0 *device; MPI2_CONFIG_PAGE_EXPANDER_1 *exp1; uint16_t IOCStatus, handle, bus, target; - char *type, *speed, enchandle[5], slot[3], bt[8]; + char *type, *speed, enchandle[8], slot[8], bt[16]; char buf[256]; int fd, error, nphys; @@ -605,11 +606,11 @@ show_devices(int ac, char **av) speed = " "; if (device->EnclosureHandle != 0) { - snprintf(enchandle, 5, "%04x", le16toh(device->EnclosureHandle)); - snprintf(slot, 3, "%02d", le16toh(device->Slot)); + snprintf(enchandle, sizeof(enchandle), "%04x", le16toh(device->EnclosureHandle)); + snprintf(slot, sizeof(slot), "%02d", le16toh(device->Slot)); } else { - snprintf(enchandle, 5, " "); - snprintf(slot, 3, " "); + snprintf(enchandle, sizeof(enchandle), " "); + snprintf(slot, sizeof(slot), " "); } printf("%-10s", bt); snprintf(buf, sizeof(buf), "%08x%08x", le32toh(device->SASAddress.High), @@ -634,7 +635,7 @@ static int show_enclosures(int ac, char **av) { MPI2_CONFIG_PAGE_SAS_ENCLOSURE_0 *enc; - char *type, sepstr[5]; + char *type, sepstr[8]; uint16_t IOCStatus, handle; int fd, error, issep; @@ -663,9 +664,9 @@ show_enclosures(int ac, char **av) } type = get_enc_type(le16toh(enc->Flags), &issep); if (issep == 0) - snprintf(sepstr, 5, " "); + snprintf(sepstr, sizeof(sepstr), " "); else - snprintf(sepstr, 5, "%04x", le16toh(enc->SEPDevHandle)); + snprintf(sepstr, sizeof(sepstr), "%04x", le16toh(enc->SEPDevHandle)); printf(" %.2d %08x%08x %s %04x %s\n", le16toh(enc->NumSlots), le32toh(enc->EnclosureLogicalID.High), le32toh(enc->EnclosureLogicalID.Low), sepstr, le16toh(enc->EnclosureHandle), @@ -685,7 +686,7 @@ show_expanders(int ac, char **av) MPI2_CONFIG_PAGE_EXPANDER_0 *exp0; MPI2_CONFIG_PAGE_EXPANDER_1 *exp1; uint16_t IOCStatus, handle; - char enchandle[5], parent[5], rphy[3], rhandle[5]; + char enchandle[8], parent[8], rphy[4], rhandle[8]; char *speed, *min, *max, *type; int fd, error, nphys, i; @@ -717,19 +718,19 @@ show_expanders(int ac, char **av) handle = le16toh(exp0->DevHandle); if (exp0->EnclosureHandle == 0x00) - snprintf(enchandle, 5, " "); + snprintf(enchandle, sizeof(enchandle), " "); else - snprintf(enchandle, 5, "%04d", le16toh(exp0->EnclosureHandle)); + snprintf(enchandle, sizeof(enchandle), "%04d", le16toh(exp0->EnclosureHandle)); if (exp0->ParentDevHandle == 0x0) - snprintf(parent, 5, " "); + snprintf(parent, sizeof(parent), " "); else - snprintf(parent, 5, "%04x", le16toh(exp0->ParentDevHandle)); + snprintf(parent, sizeof(parent), "%04x", le16toh(exp0->ParentDevHandle)); printf(" %02d %08x%08x %04x %s %s %d\n", exp0->NumPhys, le32toh(exp0->SASAddress.High), le32toh(exp0->SASAddress.Low), le16toh(exp0->DevHandle), parent, enchandle, exp0->SASLevel); printf("\n"); - printf(" Phy RemotePhy DevHandle Speed Min Max Device\n"); + printf(" Phy RemotePhy DevHandle Speed Min Max Device\n"); for (i = 0; i < nphys; i++) { exp1 = mps_read_extended_config_page(fd, MPI2_CONFIG_EXTPAGETYPE_SAS_EXPANDER, @@ -745,20 +746,20 @@ show_expanders(int ac, char **av) } type = get_device_type(le32toh(exp1->AttachedDeviceInfo)); if ((le32toh(exp1->AttachedDeviceInfo) &0x7) == 0) { - speed = " "; - snprintf(rphy, 3, " "); - snprintf(rhandle, 5, " "); + speed = " "; + snprintf(rphy, sizeof(rphy), " "); + snprintf(rhandle, sizeof(rhandle), " "); } else { speed = get_device_speed( exp1->NegotiatedLinkRate); - snprintf(rphy, 3, "%02d", + snprintf(rphy, sizeof(rphy), "%02d", exp1->AttachedPhyIdentifier); - snprintf(rhandle, 5, "%04x", + snprintf(rhandle, sizeof(rhandle), "%04x", le16toh(exp1->AttachedDevHandle)); } min = get_device_speed(exp1->HwLinkRate); max = get_device_speed(exp1->HwLinkRate >> 4); - printf(" %02d %s %s %s %s %s %s\n", exp1->Phy, rphy, rhandle, speed, min, max, type); + printf(" %02d %s %s %s %s %s %s\n", exp1->Phy, rphy, rhandle, speed, min, max, type); free(exp1); }