diff options
author | Dan Carpenter <error27@gmail.com> | 2011-06-15 13:03:05 -0400 |
---|---|---|
committer | Nicholas Bellinger <nab@linux-iscsi.org> | 2011-06-23 20:08:11 -0400 |
commit | 60d645a4e9e7e7ddc20e534fea82aa4e6947f911 (patch) | |
tree | 656848db8b14b92993df040058df24ce7012cb8b /drivers | |
parent | 5eff5be0b1993f4291f2b8c6d035b408010f96c5 (diff) |
target: Fix incorrect strlen() NULL terminator checks
This patch fixes a number of cases in target core using an incorrectly
if (strlen(foo) > SOME_MAX_SIZE)
As strlen() returns the number of characters in the string not counting
the NULL character at the end. So if you do something like:
char buf[10];
if (strlen("0123456789") > 10)
return -ETOOLONG;
snprintf(buf, 10, "0123456789");
printf("%s\n", buf);
then the last "9" gets chopped off and only "012345678" is printed.
Plus I threw in one small related cleanup.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Diffstat (limited to 'drivers')
-rw-r--r-- | drivers/target/loopback/tcm_loop.c | 4 | ||||
-rw-r--r-- | drivers/target/target_core_configfs.c | 22 | ||||
-rw-r--r-- | drivers/target/target_core_device.c | 2 | ||||
-rw-r--r-- | drivers/target/target_core_pr.c | 6 |
4 files changed, 17 insertions, 17 deletions
diff --git a/drivers/target/loopback/tcm_loop.c b/drivers/target/loopback/tcm_loop.c index d4fee2a9d66a..70c2e7fa6664 100644 --- a/drivers/target/loopback/tcm_loop.c +++ b/drivers/target/loopback/tcm_loop.c | |||
@@ -1143,7 +1143,7 @@ static ssize_t tcm_loop_tpg_store_nexus( | |||
1143 | * the fabric protocol_id set in tcm_loop_make_scsi_hba(), and call | 1143 | * the fabric protocol_id set in tcm_loop_make_scsi_hba(), and call |
1144 | * tcm_loop_make_nexus() | 1144 | * tcm_loop_make_nexus() |
1145 | */ | 1145 | */ |
1146 | if (strlen(page) > TL_WWN_ADDR_LEN) { | 1146 | if (strlen(page) >= TL_WWN_ADDR_LEN) { |
1147 | printk(KERN_ERR "Emulated NAA Sas Address: %s, exceeds" | 1147 | printk(KERN_ERR "Emulated NAA Sas Address: %s, exceeds" |
1148 | " max: %d\n", page, TL_WWN_ADDR_LEN); | 1148 | " max: %d\n", page, TL_WWN_ADDR_LEN); |
1149 | return -EINVAL; | 1149 | return -EINVAL; |
@@ -1324,7 +1324,7 @@ struct se_wwn *tcm_loop_make_scsi_hba( | |||
1324 | return ERR_PTR(-EINVAL); | 1324 | return ERR_PTR(-EINVAL); |
1325 | 1325 | ||
1326 | check_len: | 1326 | check_len: |
1327 | if (strlen(name) > TL_WWN_ADDR_LEN) { | 1327 | if (strlen(name) >= TL_WWN_ADDR_LEN) { |
1328 | printk(KERN_ERR "Emulated NAA %s Address: %s, exceeds" | 1328 | printk(KERN_ERR "Emulated NAA %s Address: %s, exceeds" |
1329 | " max: %d\n", name, tcm_loop_dump_proto_id(tl_hba), | 1329 | " max: %d\n", name, tcm_loop_dump_proto_id(tl_hba), |
1330 | TL_WWN_ADDR_LEN); | 1330 | TL_WWN_ADDR_LEN); |
diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c index b17abd13c8e3..25c1f49a7d8b 100644 --- a/drivers/target/target_core_configfs.c +++ b/drivers/target/target_core_configfs.c | |||
@@ -304,7 +304,7 @@ struct target_fabric_configfs *target_fabric_configfs_init( | |||
304 | printk(KERN_ERR "Unable to locate passed fabric name\n"); | 304 | printk(KERN_ERR "Unable to locate passed fabric name\n"); |
305 | return NULL; | 305 | return NULL; |
306 | } | 306 | } |
307 | if (strlen(name) > TARGET_FABRIC_NAME_SIZE) { | 307 | if (strlen(name) >= TARGET_FABRIC_NAME_SIZE) { |
308 | printk(KERN_ERR "Passed name: %s exceeds TARGET_FABRIC" | 308 | printk(KERN_ERR "Passed name: %s exceeds TARGET_FABRIC" |
309 | "_NAME_SIZE\n", name); | 309 | "_NAME_SIZE\n", name); |
310 | return NULL; | 310 | return NULL; |
@@ -851,7 +851,7 @@ static ssize_t target_core_dev_wwn_store_attr_vpd_unit_serial( | |||
851 | return -EOPNOTSUPP; | 851 | return -EOPNOTSUPP; |
852 | } | 852 | } |
853 | 853 | ||
854 | if ((strlen(page) + 1) > INQUIRY_VPD_SERIAL_LEN) { | 854 | if (strlen(page) >= INQUIRY_VPD_SERIAL_LEN) { |
855 | printk(KERN_ERR "Emulated VPD Unit Serial exceeds" | 855 | printk(KERN_ERR "Emulated VPD Unit Serial exceeds" |
856 | " INQUIRY_VPD_SERIAL_LEN: %d\n", INQUIRY_VPD_SERIAL_LEN); | 856 | " INQUIRY_VPD_SERIAL_LEN: %d\n", INQUIRY_VPD_SERIAL_LEN); |
857 | return -EOVERFLOW; | 857 | return -EOVERFLOW; |
@@ -917,7 +917,7 @@ static ssize_t target_core_dev_wwn_show_attr_vpd_protocol_identifier( | |||
917 | 917 | ||
918 | transport_dump_vpd_proto_id(vpd, buf, VPD_TMP_BUF_SIZE); | 918 | transport_dump_vpd_proto_id(vpd, buf, VPD_TMP_BUF_SIZE); |
919 | 919 | ||
920 | if ((len + strlen(buf) > PAGE_SIZE)) | 920 | if ((len + strlen(buf) >= PAGE_SIZE)) |
921 | break; | 921 | break; |
922 | 922 | ||
923 | len += sprintf(page+len, "%s", buf); | 923 | len += sprintf(page+len, "%s", buf); |
@@ -962,19 +962,19 @@ static ssize_t target_core_dev_wwn_show_attr_##_name( \ | |||
962 | \ | 962 | \ |
963 | memset(buf, 0, VPD_TMP_BUF_SIZE); \ | 963 | memset(buf, 0, VPD_TMP_BUF_SIZE); \ |
964 | transport_dump_vpd_assoc(vpd, buf, VPD_TMP_BUF_SIZE); \ | 964 | transport_dump_vpd_assoc(vpd, buf, VPD_TMP_BUF_SIZE); \ |
965 | if ((len + strlen(buf) > PAGE_SIZE)) \ | 965 | if ((len + strlen(buf) >= PAGE_SIZE)) \ |
966 | break; \ | 966 | break; \ |
967 | len += sprintf(page+len, "%s", buf); \ | 967 | len += sprintf(page+len, "%s", buf); \ |
968 | \ | 968 | \ |
969 | memset(buf, 0, VPD_TMP_BUF_SIZE); \ | 969 | memset(buf, 0, VPD_TMP_BUF_SIZE); \ |
970 | transport_dump_vpd_ident_type(vpd, buf, VPD_TMP_BUF_SIZE); \ | 970 | transport_dump_vpd_ident_type(vpd, buf, VPD_TMP_BUF_SIZE); \ |
971 | if ((len + strlen(buf) > PAGE_SIZE)) \ | 971 | if ((len + strlen(buf) >= PAGE_SIZE)) \ |
972 | break; \ | 972 | break; \ |
973 | len += sprintf(page+len, "%s", buf); \ | 973 | len += sprintf(page+len, "%s", buf); \ |
974 | \ | 974 | \ |
975 | memset(buf, 0, VPD_TMP_BUF_SIZE); \ | 975 | memset(buf, 0, VPD_TMP_BUF_SIZE); \ |
976 | transport_dump_vpd_ident(vpd, buf, VPD_TMP_BUF_SIZE); \ | 976 | transport_dump_vpd_ident(vpd, buf, VPD_TMP_BUF_SIZE); \ |
977 | if ((len + strlen(buf) > PAGE_SIZE)) \ | 977 | if ((len + strlen(buf) >= PAGE_SIZE)) \ |
978 | break; \ | 978 | break; \ |
979 | len += sprintf(page+len, "%s", buf); \ | 979 | len += sprintf(page+len, "%s", buf); \ |
980 | } \ | 980 | } \ |
@@ -1299,7 +1299,7 @@ static ssize_t target_core_dev_pr_show_attr_res_pr_registered_i_pts( | |||
1299 | &i_buf[0] : "", pr_reg->pr_res_key, | 1299 | &i_buf[0] : "", pr_reg->pr_res_key, |
1300 | pr_reg->pr_res_generation); | 1300 | pr_reg->pr_res_generation); |
1301 | 1301 | ||
1302 | if ((len + strlen(buf) > PAGE_SIZE)) | 1302 | if ((len + strlen(buf) >= PAGE_SIZE)) |
1303 | break; | 1303 | break; |
1304 | 1304 | ||
1305 | len += sprintf(page+len, "%s", buf); | 1305 | len += sprintf(page+len, "%s", buf); |
@@ -1496,7 +1496,7 @@ static ssize_t target_core_dev_pr_store_attr_res_aptpl_metadata( | |||
1496 | ret = -ENOMEM; | 1496 | ret = -ENOMEM; |
1497 | goto out; | 1497 | goto out; |
1498 | } | 1498 | } |
1499 | if (strlen(i_port) > PR_APTPL_MAX_IPORT_LEN) { | 1499 | if (strlen(i_port) >= PR_APTPL_MAX_IPORT_LEN) { |
1500 | printk(KERN_ERR "APTPL metadata initiator_node=" | 1500 | printk(KERN_ERR "APTPL metadata initiator_node=" |
1501 | " exceeds PR_APTPL_MAX_IPORT_LEN: %d\n", | 1501 | " exceeds PR_APTPL_MAX_IPORT_LEN: %d\n", |
1502 | PR_APTPL_MAX_IPORT_LEN); | 1502 | PR_APTPL_MAX_IPORT_LEN); |
@@ -1510,7 +1510,7 @@ static ssize_t target_core_dev_pr_store_attr_res_aptpl_metadata( | |||
1510 | ret = -ENOMEM; | 1510 | ret = -ENOMEM; |
1511 | goto out; | 1511 | goto out; |
1512 | } | 1512 | } |
1513 | if (strlen(isid) > PR_REG_ISID_LEN) { | 1513 | if (strlen(isid) >= PR_REG_ISID_LEN) { |
1514 | printk(KERN_ERR "APTPL metadata initiator_isid" | 1514 | printk(KERN_ERR "APTPL metadata initiator_isid" |
1515 | "= exceeds PR_REG_ISID_LEN: %d\n", | 1515 | "= exceeds PR_REG_ISID_LEN: %d\n", |
1516 | PR_REG_ISID_LEN); | 1516 | PR_REG_ISID_LEN); |
@@ -1571,7 +1571,7 @@ static ssize_t target_core_dev_pr_store_attr_res_aptpl_metadata( | |||
1571 | ret = -ENOMEM; | 1571 | ret = -ENOMEM; |
1572 | goto out; | 1572 | goto out; |
1573 | } | 1573 | } |
1574 | if (strlen(t_port) > PR_APTPL_MAX_TPORT_LEN) { | 1574 | if (strlen(t_port) >= PR_APTPL_MAX_TPORT_LEN) { |
1575 | printk(KERN_ERR "APTPL metadata target_node=" | 1575 | printk(KERN_ERR "APTPL metadata target_node=" |
1576 | " exceeds PR_APTPL_MAX_TPORT_LEN: %d\n", | 1576 | " exceeds PR_APTPL_MAX_TPORT_LEN: %d\n", |
1577 | PR_APTPL_MAX_TPORT_LEN); | 1577 | PR_APTPL_MAX_TPORT_LEN); |
@@ -3052,7 +3052,7 @@ static struct config_group *target_core_call_addhbatotarget( | |||
3052 | int ret; | 3052 | int ret; |
3053 | 3053 | ||
3054 | memset(buf, 0, TARGET_CORE_NAME_MAX_LEN); | 3054 | memset(buf, 0, TARGET_CORE_NAME_MAX_LEN); |
3055 | if (strlen(name) > TARGET_CORE_NAME_MAX_LEN) { | 3055 | if (strlen(name) >= TARGET_CORE_NAME_MAX_LEN) { |
3056 | printk(KERN_ERR "Passed *name strlen(): %d exceeds" | 3056 | printk(KERN_ERR "Passed *name strlen(): %d exceeds" |
3057 | " TARGET_CORE_NAME_MAX_LEN: %d\n", (int)strlen(name), | 3057 | " TARGET_CORE_NAME_MAX_LEN: %d\n", (int)strlen(name), |
3058 | TARGET_CORE_NAME_MAX_LEN); | 3058 | TARGET_CORE_NAME_MAX_LEN); |
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c index f8d8af7a0d41..ba698ea62bb2 100644 --- a/drivers/target/target_core_device.c +++ b/drivers/target/target_core_device.c | |||
@@ -1431,7 +1431,7 @@ struct se_lun_acl *core_dev_init_initiator_node_lun_acl( | |||
1431 | struct se_lun_acl *lacl; | 1431 | struct se_lun_acl *lacl; |
1432 | struct se_node_acl *nacl; | 1432 | struct se_node_acl *nacl; |
1433 | 1433 | ||
1434 | if (strlen(initiatorname) > TRANSPORT_IQN_LEN) { | 1434 | if (strlen(initiatorname) >= TRANSPORT_IQN_LEN) { |
1435 | printk(KERN_ERR "%s InitiatorName exceeds maximum size.\n", | 1435 | printk(KERN_ERR "%s InitiatorName exceeds maximum size.\n", |
1436 | TPG_TFO(tpg)->get_fabric_name()); | 1436 | TPG_TFO(tpg)->get_fabric_name()); |
1437 | *ret = -EOVERFLOW; | 1437 | *ret = -EOVERFLOW; |
diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c index a79f518ca6e2..b662db3a320b 100644 --- a/drivers/target/target_core_pr.c +++ b/drivers/target/target_core_pr.c | |||
@@ -1916,7 +1916,7 @@ static int __core_scsi3_update_aptpl_buf( | |||
1916 | pr_reg->pr_res_mapped_lun); | 1916 | pr_reg->pr_res_mapped_lun); |
1917 | } | 1917 | } |
1918 | 1918 | ||
1919 | if ((len + strlen(tmp) > pr_aptpl_buf_len)) { | 1919 | if ((len + strlen(tmp) >= pr_aptpl_buf_len)) { |
1920 | printk(KERN_ERR "Unable to update renaming" | 1920 | printk(KERN_ERR "Unable to update renaming" |
1921 | " APTPL metadata\n"); | 1921 | " APTPL metadata\n"); |
1922 | spin_unlock(&T10_RES(su_dev)->registration_lock); | 1922 | spin_unlock(&T10_RES(su_dev)->registration_lock); |
@@ -1934,7 +1934,7 @@ static int __core_scsi3_update_aptpl_buf( | |||
1934 | TPG_TFO(tpg)->tpg_get_tag(tpg), | 1934 | TPG_TFO(tpg)->tpg_get_tag(tpg), |
1935 | lun->lun_sep->sep_rtpi, lun->unpacked_lun, reg_count); | 1935 | lun->lun_sep->sep_rtpi, lun->unpacked_lun, reg_count); |
1936 | 1936 | ||
1937 | if ((len + strlen(tmp) > pr_aptpl_buf_len)) { | 1937 | if ((len + strlen(tmp) >= pr_aptpl_buf_len)) { |
1938 | printk(KERN_ERR "Unable to update renaming" | 1938 | printk(KERN_ERR "Unable to update renaming" |
1939 | " APTPL metadata\n"); | 1939 | " APTPL metadata\n"); |
1940 | spin_unlock(&T10_RES(su_dev)->registration_lock); | 1940 | spin_unlock(&T10_RES(su_dev)->registration_lock); |
@@ -1986,7 +1986,7 @@ static int __core_scsi3_write_aptpl_to_file( | |||
1986 | memset(iov, 0, sizeof(struct iovec)); | 1986 | memset(iov, 0, sizeof(struct iovec)); |
1987 | memset(path, 0, 512); | 1987 | memset(path, 0, 512); |
1988 | 1988 | ||
1989 | if (strlen(&wwn->unit_serial[0]) > 512) { | 1989 | if (strlen(&wwn->unit_serial[0]) >= 512) { |
1990 | printk(KERN_ERR "WWN value for struct se_device does not fit" | 1990 | printk(KERN_ERR "WWN value for struct se_device does not fit" |
1991 | " into path buffer\n"); | 1991 | " into path buffer\n"); |
1992 | return -1; | 1992 | return -1; |