diff options
| author | Dan Carpenter <error27@gmail.com> | 2011-06-15 13:03:05 -0400 |
|---|---|---|
| committer | Nicholas Bellinger <nab@linux-iscsi.org> | 2011-06-23 20:08:11 -0400 |
| commit | 60d645a4e9e7e7ddc20e534fea82aa4e6947f911 (patch) | |
| tree | 656848db8b14b92993df040058df24ce7012cb8b /drivers | |
| parent | 5eff5be0b1993f4291f2b8c6d035b408010f96c5 (diff) | |
target: Fix incorrect strlen() NULL terminator checks
This patch fixes a number of cases in target core using an incorrectly
if (strlen(foo) > SOME_MAX_SIZE)
As strlen() returns the number of characters in the string not counting
the NULL character at the end. So if you do something like:
char buf[10];
if (strlen("0123456789") > 10)
return -ETOOLONG;
snprintf(buf, 10, "0123456789");
printf("%s\n", buf);
then the last "9" gets chopped off and only "012345678" is printed.
Plus I threw in one small related cleanup.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/target/loopback/tcm_loop.c | 4 | ||||
| -rw-r--r-- | drivers/target/target_core_configfs.c | 22 | ||||
| -rw-r--r-- | drivers/target/target_core_device.c | 2 | ||||
| -rw-r--r-- | drivers/target/target_core_pr.c | 6 |
4 files changed, 17 insertions, 17 deletions
diff --git a/drivers/target/loopback/tcm_loop.c b/drivers/target/loopback/tcm_loop.c index d4fee2a9d66a..70c2e7fa6664 100644 --- a/drivers/target/loopback/tcm_loop.c +++ b/drivers/target/loopback/tcm_loop.c | |||
| @@ -1143,7 +1143,7 @@ static ssize_t tcm_loop_tpg_store_nexus( | |||
| 1143 | * the fabric protocol_id set in tcm_loop_make_scsi_hba(), and call | 1143 | * the fabric protocol_id set in tcm_loop_make_scsi_hba(), and call |
| 1144 | * tcm_loop_make_nexus() | 1144 | * tcm_loop_make_nexus() |
| 1145 | */ | 1145 | */ |
| 1146 | if (strlen(page) > TL_WWN_ADDR_LEN) { | 1146 | if (strlen(page) >= TL_WWN_ADDR_LEN) { |
| 1147 | printk(KERN_ERR "Emulated NAA Sas Address: %s, exceeds" | 1147 | printk(KERN_ERR "Emulated NAA Sas Address: %s, exceeds" |
| 1148 | " max: %d\n", page, TL_WWN_ADDR_LEN); | 1148 | " max: %d\n", page, TL_WWN_ADDR_LEN); |
| 1149 | return -EINVAL; | 1149 | return -EINVAL; |
| @@ -1324,7 +1324,7 @@ struct se_wwn *tcm_loop_make_scsi_hba( | |||
| 1324 | return ERR_PTR(-EINVAL); | 1324 | return ERR_PTR(-EINVAL); |
| 1325 | 1325 | ||
| 1326 | check_len: | 1326 | check_len: |
| 1327 | if (strlen(name) > TL_WWN_ADDR_LEN) { | 1327 | if (strlen(name) >= TL_WWN_ADDR_LEN) { |
| 1328 | printk(KERN_ERR "Emulated NAA %s Address: %s, exceeds" | 1328 | printk(KERN_ERR "Emulated NAA %s Address: %s, exceeds" |
| 1329 | " max: %d\n", name, tcm_loop_dump_proto_id(tl_hba), | 1329 | " max: %d\n", name, tcm_loop_dump_proto_id(tl_hba), |
| 1330 | TL_WWN_ADDR_LEN); | 1330 | TL_WWN_ADDR_LEN); |
diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c index b17abd13c8e3..25c1f49a7d8b 100644 --- a/drivers/target/target_core_configfs.c +++ b/drivers/target/target_core_configfs.c | |||
| @@ -304,7 +304,7 @@ struct target_fabric_configfs *target_fabric_configfs_init( | |||
| 304 | printk(KERN_ERR "Unable to locate passed fabric name\n"); | 304 | printk(KERN_ERR "Unable to locate passed fabric name\n"); |
| 305 | return NULL; | 305 | return NULL; |
| 306 | } | 306 | } |
| 307 | if (strlen(name) > TARGET_FABRIC_NAME_SIZE) { | 307 | if (strlen(name) >= TARGET_FABRIC_NAME_SIZE) { |
| 308 | printk(KERN_ERR "Passed name: %s exceeds TARGET_FABRIC" | 308 | printk(KERN_ERR "Passed name: %s exceeds TARGET_FABRIC" |
| 309 | "_NAME_SIZE\n", name); | 309 | "_NAME_SIZE\n", name); |
| 310 | return NULL; | 310 | return NULL; |
| @@ -851,7 +851,7 @@ static ssize_t target_core_dev_wwn_store_attr_vpd_unit_serial( | |||
| 851 | return -EOPNOTSUPP; | 851 | return -EOPNOTSUPP; |
| 852 | } | 852 | } |
| 853 | 853 | ||
| 854 | if ((strlen(page) + 1) > INQUIRY_VPD_SERIAL_LEN) { | 854 | if (strlen(page) >= INQUIRY_VPD_SERIAL_LEN) { |
| 855 | printk(KERN_ERR "Emulated VPD Unit Serial exceeds" | 855 | printk(KERN_ERR "Emulated VPD Unit Serial exceeds" |
| 856 | " INQUIRY_VPD_SERIAL_LEN: %d\n", INQUIRY_VPD_SERIAL_LEN); | 856 | " INQUIRY_VPD_SERIAL_LEN: %d\n", INQUIRY_VPD_SERIAL_LEN); |
| 857 | return -EOVERFLOW; | 857 | return -EOVERFLOW; |
| @@ -917,7 +917,7 @@ static ssize_t target_core_dev_wwn_show_attr_vpd_protocol_identifier( | |||
| 917 | 917 | ||
| 918 | transport_dump_vpd_proto_id(vpd, buf, VPD_TMP_BUF_SIZE); | 918 | transport_dump_vpd_proto_id(vpd, buf, VPD_TMP_BUF_SIZE); |
| 919 | 919 | ||
| 920 | if ((len + strlen(buf) > PAGE_SIZE)) | 920 | if ((len + strlen(buf) >= PAGE_SIZE)) |
| 921 | break; | 921 | break; |
| 922 | 922 | ||
| 923 | len += sprintf(page+len, "%s", buf); | 923 | len += sprintf(page+len, "%s", buf); |
| @@ -962,19 +962,19 @@ static ssize_t target_core_dev_wwn_show_attr_##_name( \ | |||
| 962 | \ | 962 | \ |
| 963 | memset(buf, 0, VPD_TMP_BUF_SIZE); \ | 963 | memset(buf, 0, VPD_TMP_BUF_SIZE); \ |
| 964 | transport_dump_vpd_assoc(vpd, buf, VPD_TMP_BUF_SIZE); \ | 964 | transport_dump_vpd_assoc(vpd, buf, VPD_TMP_BUF_SIZE); \ |
| 965 | if ((len + strlen(buf) > PAGE_SIZE)) \ | 965 | if ((len + strlen(buf) >= PAGE_SIZE)) \ |
| 966 | break; \ | 966 | break; \ |
| 967 | len += sprintf(page+len, "%s", buf); \ | 967 | len += sprintf(page+len, "%s", buf); \ |
| 968 | \ | 968 | \ |
| 969 | memset(buf, 0, VPD_TMP_BUF_SIZE); \ | 969 | memset(buf, 0, VPD_TMP_BUF_SIZE); \ |
| 970 | transport_dump_vpd_ident_type(vpd, buf, VPD_TMP_BUF_SIZE); \ | 970 | transport_dump_vpd_ident_type(vpd, buf, VPD_TMP_BUF_SIZE); \ |
| 971 | if ((len + strlen(buf) > PAGE_SIZE)) \ | 971 | if ((len + strlen(buf) >= PAGE_SIZE)) \ |
| 972 | break; \ | 972 | break; \ |
| 973 | len += sprintf(page+len, "%s", buf); \ | 973 | len += sprintf(page+len, "%s", buf); \ |
| 974 | \ | 974 | \ |
| 975 | memset(buf, 0, VPD_TMP_BUF_SIZE); \ | 975 | memset(buf, 0, VPD_TMP_BUF_SIZE); \ |
| 976 | transport_dump_vpd_ident(vpd, buf, VPD_TMP_BUF_SIZE); \ | 976 | transport_dump_vpd_ident(vpd, buf, VPD_TMP_BUF_SIZE); \ |
| 977 | if ((len + strlen(buf) > PAGE_SIZE)) \ | 977 | if ((len + strlen(buf) >= PAGE_SIZE)) \ |
| 978 | break; \ | 978 | break; \ |
| 979 | len += sprintf(page+len, "%s", buf); \ | 979 | len += sprintf(page+len, "%s", buf); \ |
| 980 | } \ | 980 | } \ |
| @@ -1299,7 +1299,7 @@ static ssize_t target_core_dev_pr_show_attr_res_pr_registered_i_pts( | |||
| 1299 | &i_buf[0] : "", pr_reg->pr_res_key, | 1299 | &i_buf[0] : "", pr_reg->pr_res_key, |
| 1300 | pr_reg->pr_res_generation); | 1300 | pr_reg->pr_res_generation); |
| 1301 | 1301 | ||
| 1302 | if ((len + strlen(buf) > PAGE_SIZE)) | 1302 | if ((len + strlen(buf) >= PAGE_SIZE)) |
| 1303 | break; | 1303 | break; |
| 1304 | 1304 | ||
| 1305 | len += sprintf(page+len, "%s", buf); | 1305 | len += sprintf(page+len, "%s", buf); |
| @@ -1496,7 +1496,7 @@ static ssize_t target_core_dev_pr_store_attr_res_aptpl_metadata( | |||
| 1496 | ret = -ENOMEM; | 1496 | ret = -ENOMEM; |
| 1497 | goto out; | 1497 | goto out; |
| 1498 | } | 1498 | } |
| 1499 | if (strlen(i_port) > PR_APTPL_MAX_IPORT_LEN) { | 1499 | if (strlen(i_port) >= PR_APTPL_MAX_IPORT_LEN) { |
| 1500 | printk(KERN_ERR "APTPL metadata initiator_node=" | 1500 | printk(KERN_ERR "APTPL metadata initiator_node=" |
| 1501 | " exceeds PR_APTPL_MAX_IPORT_LEN: %d\n", | 1501 | " exceeds PR_APTPL_MAX_IPORT_LEN: %d\n", |
| 1502 | PR_APTPL_MAX_IPORT_LEN); | 1502 | PR_APTPL_MAX_IPORT_LEN); |
| @@ -1510,7 +1510,7 @@ static ssize_t target_core_dev_pr_store_attr_res_aptpl_metadata( | |||
| 1510 | ret = -ENOMEM; | 1510 | ret = -ENOMEM; |
| 1511 | goto out; | 1511 | goto out; |
| 1512 | } | 1512 | } |
| 1513 | if (strlen(isid) > PR_REG_ISID_LEN) { | 1513 | if (strlen(isid) >= PR_REG_ISID_LEN) { |
| 1514 | printk(KERN_ERR "APTPL metadata initiator_isid" | 1514 | printk(KERN_ERR "APTPL metadata initiator_isid" |
| 1515 | "= exceeds PR_REG_ISID_LEN: %d\n", | 1515 | "= exceeds PR_REG_ISID_LEN: %d\n", |
| 1516 | PR_REG_ISID_LEN); | 1516 | PR_REG_ISID_LEN); |
| @@ -1571,7 +1571,7 @@ static ssize_t target_core_dev_pr_store_attr_res_aptpl_metadata( | |||
| 1571 | ret = -ENOMEM; | 1571 | ret = -ENOMEM; |
| 1572 | goto out; | 1572 | goto out; |
| 1573 | } | 1573 | } |
| 1574 | if (strlen(t_port) > PR_APTPL_MAX_TPORT_LEN) { | 1574 | if (strlen(t_port) >= PR_APTPL_MAX_TPORT_LEN) { |
| 1575 | printk(KERN_ERR "APTPL metadata target_node=" | 1575 | printk(KERN_ERR "APTPL metadata target_node=" |
| 1576 | " exceeds PR_APTPL_MAX_TPORT_LEN: %d\n", | 1576 | " exceeds PR_APTPL_MAX_TPORT_LEN: %d\n", |
| 1577 | PR_APTPL_MAX_TPORT_LEN); | 1577 | PR_APTPL_MAX_TPORT_LEN); |
| @@ -3052,7 +3052,7 @@ static struct config_group *target_core_call_addhbatotarget( | |||
| 3052 | int ret; | 3052 | int ret; |
| 3053 | 3053 | ||
| 3054 | memset(buf, 0, TARGET_CORE_NAME_MAX_LEN); | 3054 | memset(buf, 0, TARGET_CORE_NAME_MAX_LEN); |
| 3055 | if (strlen(name) > TARGET_CORE_NAME_MAX_LEN) { | 3055 | if (strlen(name) >= TARGET_CORE_NAME_MAX_LEN) { |
| 3056 | printk(KERN_ERR "Passed *name strlen(): %d exceeds" | 3056 | printk(KERN_ERR "Passed *name strlen(): %d exceeds" |
| 3057 | " TARGET_CORE_NAME_MAX_LEN: %d\n", (int)strlen(name), | 3057 | " TARGET_CORE_NAME_MAX_LEN: %d\n", (int)strlen(name), |
| 3058 | TARGET_CORE_NAME_MAX_LEN); | 3058 | TARGET_CORE_NAME_MAX_LEN); |
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c index f8d8af7a0d41..ba698ea62bb2 100644 --- a/drivers/target/target_core_device.c +++ b/drivers/target/target_core_device.c | |||
| @@ -1431,7 +1431,7 @@ struct se_lun_acl *core_dev_init_initiator_node_lun_acl( | |||
| 1431 | struct se_lun_acl *lacl; | 1431 | struct se_lun_acl *lacl; |
| 1432 | struct se_node_acl *nacl; | 1432 | struct se_node_acl *nacl; |
| 1433 | 1433 | ||
| 1434 | if (strlen(initiatorname) > TRANSPORT_IQN_LEN) { | 1434 | if (strlen(initiatorname) >= TRANSPORT_IQN_LEN) { |
| 1435 | printk(KERN_ERR "%s InitiatorName exceeds maximum size.\n", | 1435 | printk(KERN_ERR "%s InitiatorName exceeds maximum size.\n", |
| 1436 | TPG_TFO(tpg)->get_fabric_name()); | 1436 | TPG_TFO(tpg)->get_fabric_name()); |
| 1437 | *ret = -EOVERFLOW; | 1437 | *ret = -EOVERFLOW; |
diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c index a79f518ca6e2..b662db3a320b 100644 --- a/drivers/target/target_core_pr.c +++ b/drivers/target/target_core_pr.c | |||
| @@ -1916,7 +1916,7 @@ static int __core_scsi3_update_aptpl_buf( | |||
| 1916 | pr_reg->pr_res_mapped_lun); | 1916 | pr_reg->pr_res_mapped_lun); |
| 1917 | } | 1917 | } |
| 1918 | 1918 | ||
| 1919 | if ((len + strlen(tmp) > pr_aptpl_buf_len)) { | 1919 | if ((len + strlen(tmp) >= pr_aptpl_buf_len)) { |
| 1920 | printk(KERN_ERR "Unable to update renaming" | 1920 | printk(KERN_ERR "Unable to update renaming" |
| 1921 | " APTPL metadata\n"); | 1921 | " APTPL metadata\n"); |
| 1922 | spin_unlock(&T10_RES(su_dev)->registration_lock); | 1922 | spin_unlock(&T10_RES(su_dev)->registration_lock); |
| @@ -1934,7 +1934,7 @@ static int __core_scsi3_update_aptpl_buf( | |||
| 1934 | TPG_TFO(tpg)->tpg_get_tag(tpg), | 1934 | TPG_TFO(tpg)->tpg_get_tag(tpg), |
| 1935 | lun->lun_sep->sep_rtpi, lun->unpacked_lun, reg_count); | 1935 | lun->lun_sep->sep_rtpi, lun->unpacked_lun, reg_count); |
| 1936 | 1936 | ||
| 1937 | if ((len + strlen(tmp) > pr_aptpl_buf_len)) { | 1937 | if ((len + strlen(tmp) >= pr_aptpl_buf_len)) { |
| 1938 | printk(KERN_ERR "Unable to update renaming" | 1938 | printk(KERN_ERR "Unable to update renaming" |
| 1939 | " APTPL metadata\n"); | 1939 | " APTPL metadata\n"); |
| 1940 | spin_unlock(&T10_RES(su_dev)->registration_lock); | 1940 | spin_unlock(&T10_RES(su_dev)->registration_lock); |
| @@ -1986,7 +1986,7 @@ static int __core_scsi3_write_aptpl_to_file( | |||
| 1986 | memset(iov, 0, sizeof(struct iovec)); | 1986 | memset(iov, 0, sizeof(struct iovec)); |
| 1987 | memset(path, 0, 512); | 1987 | memset(path, 0, 512); |
| 1988 | 1988 | ||
| 1989 | if (strlen(&wwn->unit_serial[0]) > 512) { | 1989 | if (strlen(&wwn->unit_serial[0]) >= 512) { |
| 1990 | printk(KERN_ERR "WWN value for struct se_device does not fit" | 1990 | printk(KERN_ERR "WWN value for struct se_device does not fit" |
| 1991 | " into path buffer\n"); | 1991 | " into path buffer\n"); |
| 1992 | return -1; | 1992 | return -1; |
