aboutsummaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
authorDan Carpenter <error27@gmail.com>2011-06-15 13:03:05 -0400
committerNicholas Bellinger <nab@linux-iscsi.org>2011-06-23 20:08:11 -0400
commit60d645a4e9e7e7ddc20e534fea82aa4e6947f911 (patch)
tree656848db8b14b92993df040058df24ce7012cb8b /drivers
parent5eff5be0b1993f4291f2b8c6d035b408010f96c5 (diff)
target: Fix incorrect strlen() NULL terminator checks
This patch fixes a number of cases in target core using an incorrectly if (strlen(foo) > SOME_MAX_SIZE) As strlen() returns the number of characters in the string not counting the NULL character at the end. So if you do something like: char buf[10]; if (strlen("0123456789") > 10) return -ETOOLONG; snprintf(buf, 10, "0123456789"); printf("%s\n", buf); then the last "9" gets chopped off and only "012345678" is printed. Plus I threw in one small related cleanup. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/target/loopback/tcm_loop.c4
-rw-r--r--drivers/target/target_core_configfs.c22
-rw-r--r--drivers/target/target_core_device.c2
-rw-r--r--drivers/target/target_core_pr.c6
4 files changed, 17 insertions, 17 deletions
diff --git a/drivers/target/loopback/tcm_loop.c b/drivers/target/loopback/tcm_loop.c
index d4fee2a9d66a..70c2e7fa6664 100644
--- a/drivers/target/loopback/tcm_loop.c
+++ b/drivers/target/loopback/tcm_loop.c
@@ -1143,7 +1143,7 @@ static ssize_t tcm_loop_tpg_store_nexus(
1143 * the fabric protocol_id set in tcm_loop_make_scsi_hba(), and call 1143 * the fabric protocol_id set in tcm_loop_make_scsi_hba(), and call
1144 * tcm_loop_make_nexus() 1144 * tcm_loop_make_nexus()
1145 */ 1145 */
1146 if (strlen(page) > TL_WWN_ADDR_LEN) { 1146 if (strlen(page) >= TL_WWN_ADDR_LEN) {
1147 printk(KERN_ERR "Emulated NAA Sas Address: %s, exceeds" 1147 printk(KERN_ERR "Emulated NAA Sas Address: %s, exceeds"
1148 " max: %d\n", page, TL_WWN_ADDR_LEN); 1148 " max: %d\n", page, TL_WWN_ADDR_LEN);
1149 return -EINVAL; 1149 return -EINVAL;
@@ -1324,7 +1324,7 @@ struct se_wwn *tcm_loop_make_scsi_hba(
1324 return ERR_PTR(-EINVAL); 1324 return ERR_PTR(-EINVAL);
1325 1325
1326check_len: 1326check_len:
1327 if (strlen(name) > TL_WWN_ADDR_LEN) { 1327 if (strlen(name) >= TL_WWN_ADDR_LEN) {
1328 printk(KERN_ERR "Emulated NAA %s Address: %s, exceeds" 1328 printk(KERN_ERR "Emulated NAA %s Address: %s, exceeds"
1329 " max: %d\n", name, tcm_loop_dump_proto_id(tl_hba), 1329 " max: %d\n", name, tcm_loop_dump_proto_id(tl_hba),
1330 TL_WWN_ADDR_LEN); 1330 TL_WWN_ADDR_LEN);
diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c
index b17abd13c8e3..25c1f49a7d8b 100644
--- a/drivers/target/target_core_configfs.c
+++ b/drivers/target/target_core_configfs.c
@@ -304,7 +304,7 @@ struct target_fabric_configfs *target_fabric_configfs_init(
304 printk(KERN_ERR "Unable to locate passed fabric name\n"); 304 printk(KERN_ERR "Unable to locate passed fabric name\n");
305 return NULL; 305 return NULL;
306 } 306 }
307 if (strlen(name) > TARGET_FABRIC_NAME_SIZE) { 307 if (strlen(name) >= TARGET_FABRIC_NAME_SIZE) {
308 printk(KERN_ERR "Passed name: %s exceeds TARGET_FABRIC" 308 printk(KERN_ERR "Passed name: %s exceeds TARGET_FABRIC"
309 "_NAME_SIZE\n", name); 309 "_NAME_SIZE\n", name);
310 return NULL; 310 return NULL;
@@ -851,7 +851,7 @@ static ssize_t target_core_dev_wwn_store_attr_vpd_unit_serial(
851 return -EOPNOTSUPP; 851 return -EOPNOTSUPP;
852 } 852 }
853 853
854 if ((strlen(page) + 1) > INQUIRY_VPD_SERIAL_LEN) { 854 if (strlen(page) >= INQUIRY_VPD_SERIAL_LEN) {
855 printk(KERN_ERR "Emulated VPD Unit Serial exceeds" 855 printk(KERN_ERR "Emulated VPD Unit Serial exceeds"
856 " INQUIRY_VPD_SERIAL_LEN: %d\n", INQUIRY_VPD_SERIAL_LEN); 856 " INQUIRY_VPD_SERIAL_LEN: %d\n", INQUIRY_VPD_SERIAL_LEN);
857 return -EOVERFLOW; 857 return -EOVERFLOW;
@@ -917,7 +917,7 @@ static ssize_t target_core_dev_wwn_show_attr_vpd_protocol_identifier(
917 917
918 transport_dump_vpd_proto_id(vpd, buf, VPD_TMP_BUF_SIZE); 918 transport_dump_vpd_proto_id(vpd, buf, VPD_TMP_BUF_SIZE);
919 919
920 if ((len + strlen(buf) > PAGE_SIZE)) 920 if ((len + strlen(buf) >= PAGE_SIZE))
921 break; 921 break;
922 922
923 len += sprintf(page+len, "%s", buf); 923 len += sprintf(page+len, "%s", buf);
@@ -962,19 +962,19 @@ static ssize_t target_core_dev_wwn_show_attr_##_name( \
962 \ 962 \
963 memset(buf, 0, VPD_TMP_BUF_SIZE); \ 963 memset(buf, 0, VPD_TMP_BUF_SIZE); \
964 transport_dump_vpd_assoc(vpd, buf, VPD_TMP_BUF_SIZE); \ 964 transport_dump_vpd_assoc(vpd, buf, VPD_TMP_BUF_SIZE); \
965 if ((len + strlen(buf) > PAGE_SIZE)) \ 965 if ((len + strlen(buf) >= PAGE_SIZE)) \
966 break; \ 966 break; \
967 len += sprintf(page+len, "%s", buf); \ 967 len += sprintf(page+len, "%s", buf); \
968 \ 968 \
969 memset(buf, 0, VPD_TMP_BUF_SIZE); \ 969 memset(buf, 0, VPD_TMP_BUF_SIZE); \
970 transport_dump_vpd_ident_type(vpd, buf, VPD_TMP_BUF_SIZE); \ 970 transport_dump_vpd_ident_type(vpd, buf, VPD_TMP_BUF_SIZE); \
971 if ((len + strlen(buf) > PAGE_SIZE)) \ 971 if ((len + strlen(buf) >= PAGE_SIZE)) \
972 break; \ 972 break; \
973 len += sprintf(page+len, "%s", buf); \ 973 len += sprintf(page+len, "%s", buf); \
974 \ 974 \
975 memset(buf, 0, VPD_TMP_BUF_SIZE); \ 975 memset(buf, 0, VPD_TMP_BUF_SIZE); \
976 transport_dump_vpd_ident(vpd, buf, VPD_TMP_BUF_SIZE); \ 976 transport_dump_vpd_ident(vpd, buf, VPD_TMP_BUF_SIZE); \
977 if ((len + strlen(buf) > PAGE_SIZE)) \ 977 if ((len + strlen(buf) >= PAGE_SIZE)) \
978 break; \ 978 break; \
979 len += sprintf(page+len, "%s", buf); \ 979 len += sprintf(page+len, "%s", buf); \
980 } \ 980 } \
@@ -1299,7 +1299,7 @@ static ssize_t target_core_dev_pr_show_attr_res_pr_registered_i_pts(
1299 &i_buf[0] : "", pr_reg->pr_res_key, 1299 &i_buf[0] : "", pr_reg->pr_res_key,
1300 pr_reg->pr_res_generation); 1300 pr_reg->pr_res_generation);
1301 1301
1302 if ((len + strlen(buf) > PAGE_SIZE)) 1302 if ((len + strlen(buf) >= PAGE_SIZE))
1303 break; 1303 break;
1304 1304
1305 len += sprintf(page+len, "%s", buf); 1305 len += sprintf(page+len, "%s", buf);
@@ -1496,7 +1496,7 @@ static ssize_t target_core_dev_pr_store_attr_res_aptpl_metadata(
1496 ret = -ENOMEM; 1496 ret = -ENOMEM;
1497 goto out; 1497 goto out;
1498 } 1498 }
1499 if (strlen(i_port) > PR_APTPL_MAX_IPORT_LEN) { 1499 if (strlen(i_port) >= PR_APTPL_MAX_IPORT_LEN) {
1500 printk(KERN_ERR "APTPL metadata initiator_node=" 1500 printk(KERN_ERR "APTPL metadata initiator_node="
1501 " exceeds PR_APTPL_MAX_IPORT_LEN: %d\n", 1501 " exceeds PR_APTPL_MAX_IPORT_LEN: %d\n",
1502 PR_APTPL_MAX_IPORT_LEN); 1502 PR_APTPL_MAX_IPORT_LEN);
@@ -1510,7 +1510,7 @@ static ssize_t target_core_dev_pr_store_attr_res_aptpl_metadata(
1510 ret = -ENOMEM; 1510 ret = -ENOMEM;
1511 goto out; 1511 goto out;
1512 } 1512 }
1513 if (strlen(isid) > PR_REG_ISID_LEN) { 1513 if (strlen(isid) >= PR_REG_ISID_LEN) {
1514 printk(KERN_ERR "APTPL metadata initiator_isid" 1514 printk(KERN_ERR "APTPL metadata initiator_isid"
1515 "= exceeds PR_REG_ISID_LEN: %d\n", 1515 "= exceeds PR_REG_ISID_LEN: %d\n",
1516 PR_REG_ISID_LEN); 1516 PR_REG_ISID_LEN);
@@ -1571,7 +1571,7 @@ static ssize_t target_core_dev_pr_store_attr_res_aptpl_metadata(
1571 ret = -ENOMEM; 1571 ret = -ENOMEM;
1572 goto out; 1572 goto out;
1573 } 1573 }
1574 if (strlen(t_port) > PR_APTPL_MAX_TPORT_LEN) { 1574 if (strlen(t_port) >= PR_APTPL_MAX_TPORT_LEN) {
1575 printk(KERN_ERR "APTPL metadata target_node=" 1575 printk(KERN_ERR "APTPL metadata target_node="
1576 " exceeds PR_APTPL_MAX_TPORT_LEN: %d\n", 1576 " exceeds PR_APTPL_MAX_TPORT_LEN: %d\n",
1577 PR_APTPL_MAX_TPORT_LEN); 1577 PR_APTPL_MAX_TPORT_LEN);
@@ -3052,7 +3052,7 @@ static struct config_group *target_core_call_addhbatotarget(
3052 int ret; 3052 int ret;
3053 3053
3054 memset(buf, 0, TARGET_CORE_NAME_MAX_LEN); 3054 memset(buf, 0, TARGET_CORE_NAME_MAX_LEN);
3055 if (strlen(name) > TARGET_CORE_NAME_MAX_LEN) { 3055 if (strlen(name) >= TARGET_CORE_NAME_MAX_LEN) {
3056 printk(KERN_ERR "Passed *name strlen(): %d exceeds" 3056 printk(KERN_ERR "Passed *name strlen(): %d exceeds"
3057 " TARGET_CORE_NAME_MAX_LEN: %d\n", (int)strlen(name), 3057 " TARGET_CORE_NAME_MAX_LEN: %d\n", (int)strlen(name),
3058 TARGET_CORE_NAME_MAX_LEN); 3058 TARGET_CORE_NAME_MAX_LEN);
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index f8d8af7a0d41..ba698ea62bb2 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -1431,7 +1431,7 @@ struct se_lun_acl *core_dev_init_initiator_node_lun_acl(
1431 struct se_lun_acl *lacl; 1431 struct se_lun_acl *lacl;
1432 struct se_node_acl *nacl; 1432 struct se_node_acl *nacl;
1433 1433
1434 if (strlen(initiatorname) > TRANSPORT_IQN_LEN) { 1434 if (strlen(initiatorname) >= TRANSPORT_IQN_LEN) {
1435 printk(KERN_ERR "%s InitiatorName exceeds maximum size.\n", 1435 printk(KERN_ERR "%s InitiatorName exceeds maximum size.\n",
1436 TPG_TFO(tpg)->get_fabric_name()); 1436 TPG_TFO(tpg)->get_fabric_name());
1437 *ret = -EOVERFLOW; 1437 *ret = -EOVERFLOW;
diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
index a79f518ca6e2..b662db3a320b 100644
--- a/drivers/target/target_core_pr.c
+++ b/drivers/target/target_core_pr.c
@@ -1916,7 +1916,7 @@ static int __core_scsi3_update_aptpl_buf(
1916 pr_reg->pr_res_mapped_lun); 1916 pr_reg->pr_res_mapped_lun);
1917 } 1917 }
1918 1918
1919 if ((len + strlen(tmp) > pr_aptpl_buf_len)) { 1919 if ((len + strlen(tmp) >= pr_aptpl_buf_len)) {
1920 printk(KERN_ERR "Unable to update renaming" 1920 printk(KERN_ERR "Unable to update renaming"
1921 " APTPL metadata\n"); 1921 " APTPL metadata\n");
1922 spin_unlock(&T10_RES(su_dev)->registration_lock); 1922 spin_unlock(&T10_RES(su_dev)->registration_lock);
@@ -1934,7 +1934,7 @@ static int __core_scsi3_update_aptpl_buf(
1934 TPG_TFO(tpg)->tpg_get_tag(tpg), 1934 TPG_TFO(tpg)->tpg_get_tag(tpg),
1935 lun->lun_sep->sep_rtpi, lun->unpacked_lun, reg_count); 1935 lun->lun_sep->sep_rtpi, lun->unpacked_lun, reg_count);
1936 1936
1937 if ((len + strlen(tmp) > pr_aptpl_buf_len)) { 1937 if ((len + strlen(tmp) >= pr_aptpl_buf_len)) {
1938 printk(KERN_ERR "Unable to update renaming" 1938 printk(KERN_ERR "Unable to update renaming"
1939 " APTPL metadata\n"); 1939 " APTPL metadata\n");
1940 spin_unlock(&T10_RES(su_dev)->registration_lock); 1940 spin_unlock(&T10_RES(su_dev)->registration_lock);
@@ -1986,7 +1986,7 @@ static int __core_scsi3_write_aptpl_to_file(
1986 memset(iov, 0, sizeof(struct iovec)); 1986 memset(iov, 0, sizeof(struct iovec));
1987 memset(path, 0, 512); 1987 memset(path, 0, 512);
1988 1988
1989 if (strlen(&wwn->unit_serial[0]) > 512) { 1989 if (strlen(&wwn->unit_serial[0]) >= 512) {
1990 printk(KERN_ERR "WWN value for struct se_device does not fit" 1990 printk(KERN_ERR "WWN value for struct se_device does not fit"
1991 " into path buffer\n"); 1991 " into path buffer\n");
1992 return -1; 1992 return -1;