svn commit: r359129 - head/sys/cam/nvme

[David Bright]

Author: dab
Date: Thu Mar 19 12:22:20 2020
New Revision: 359129
URL: https://svnweb.freebsd.org/changeset/base/359129

Log:
  Fix parameter reversal potentially causing buffer overrun.
  
  Two arguments were reversed in calls to cam_strvis() in
  nvme_da.c. This was found by a Coverity scan of this code within Dell
  (Isilon). These are also marked in the FreeBSD Coverity scan as CIDs
  1400526 & 1400531.
  
  Submitted by:	robert.herndon at dell.com
  Reviewed by:	vangyzen@, imp@
  MFC after:	3 days
  Sponsored by:	Dell EMC Isilon
  Differential Revision:	https://reviews.freebsd.org/D24117

Modified:
  head/sys/cam/nvme/nvme_da.c

Modified: head/sys/cam/nvme/nvme_da.c
==============================================================================
--- head/sys/cam/nvme/nvme_da.c	Thu Mar 19 10:32:38 2020	(r359128)
+++ head/sys/cam/nvme/nvme_da.c	Thu Mar 19 12:22:20 2020	(r359129)
@@ -815,9 +815,9 @@ ndaregister(struct cam_periph *periph, void *arg)
 	 *  the serial or model number strings.
 	 */
 	cam_strvis(disk->d_descr, cd->mn,
-	    sizeof(disk->d_descr), NVME_MODEL_NUMBER_LENGTH);
+	    NVME_MODEL_NUMBER_LENGTH, sizeof(disk->d_descr));
 	cam_strvis(disk->d_ident, cd->sn,
-	    sizeof(disk->d_ident), NVME_SERIAL_NUMBER_LENGTH);
+	    NVME_SERIAL_NUMBER_LENGTH, sizeof(disk->d_ident));
 	disk->d_hba_vendor = cpi.hba_vendor;
 	disk->d_hba_device = cpi.hba_device;
 	disk->d_hba_subvendor = cpi.hba_subvendor;