mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-07 00:59:06 +00:00
scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly
[ Upstream commit25dbc20dea
] The qedf_dbg_fp_int_cmd_read() function invokes sprintf() directly on a __user pointer, which may crash the kernel. Avoid doing that by vmalloc()'ating a buffer for scnprintf() and then calling simple_read_from_buffer() which does a proper copy_to_user() call. Fixes:61d8658b4a
("scsi: qedf: Add QLogic FastLinQ offload FCoE driver framework.") Link: https://lore.kernel.org/lkml/20230724120241.40495-1-oleksandr@redhat.com/ Link: https://lore.kernel.org/linux-scsi/20230726101236.11922-1-skashyap@marvell.com/ Cc: Saurav Kashyap <skashyap@marvell.com> Cc: Rob Evers <revers@redhat.com> Cc: Johannes Thumshirn <Johannes.Thumshirn@wdc.com> Cc: David Laight <David.Laight@ACULAB.COM> Cc: Jozef Bacik <jobacik@redhat.com> Cc: Laurence Oberman <loberman@redhat.com> Cc: "James E.J. Bottomley" <jejb@linux.ibm.com> Cc: "Martin K. Petersen" <martin.petersen@oracle.com> Cc: GR-QLogic-Storage-Upstream@marvell.com Cc: linux-scsi@vger.kernel.org Reviewed-by: Laurence Oberman <loberman@redhat.com> Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com> Tested-by: Laurence Oberman <loberman@redhat.com> Acked-by: Saurav Kashyap <skashyap@marvell.com> Signed-off-by: Oleksandr Natalenko <oleksandr@redhat.com> Link: https://lore.kernel.org/r/20230731084034.37021-4-oleksandr@redhat.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
dd8ce1c9ff
commit
af6fd0b3bc
2 changed files with 17 additions and 6 deletions
|
@ -59,6 +59,8 @@ extern uint qedf_debug;
|
||||||
#define QEDF_LOG_NOTICE 0x40000000 /* Notice logs */
|
#define QEDF_LOG_NOTICE 0x40000000 /* Notice logs */
|
||||||
#define QEDF_LOG_WARN 0x80000000 /* Warning logs */
|
#define QEDF_LOG_WARN 0x80000000 /* Warning logs */
|
||||||
|
|
||||||
|
#define QEDF_DEBUGFS_LOG_LEN (2 * PAGE_SIZE)
|
||||||
|
|
||||||
/* Debug context structure */
|
/* Debug context structure */
|
||||||
struct qedf_dbg_ctx {
|
struct qedf_dbg_ctx {
|
||||||
unsigned int host_no;
|
unsigned int host_no;
|
||||||
|
|
|
@ -8,6 +8,7 @@
|
||||||
#include <linux/uaccess.h>
|
#include <linux/uaccess.h>
|
||||||
#include <linux/debugfs.h>
|
#include <linux/debugfs.h>
|
||||||
#include <linux/module.h>
|
#include <linux/module.h>
|
||||||
|
#include <linux/vmalloc.h>
|
||||||
|
|
||||||
#include "qedf.h"
|
#include "qedf.h"
|
||||||
#include "qedf_dbg.h"
|
#include "qedf_dbg.h"
|
||||||
|
@ -98,7 +99,9 @@ static ssize_t
|
||||||
qedf_dbg_fp_int_cmd_read(struct file *filp, char __user *buffer, size_t count,
|
qedf_dbg_fp_int_cmd_read(struct file *filp, char __user *buffer, size_t count,
|
||||||
loff_t *ppos)
|
loff_t *ppos)
|
||||||
{
|
{
|
||||||
|
ssize_t ret;
|
||||||
size_t cnt = 0;
|
size_t cnt = 0;
|
||||||
|
char *cbuf;
|
||||||
int id;
|
int id;
|
||||||
struct qedf_fastpath *fp = NULL;
|
struct qedf_fastpath *fp = NULL;
|
||||||
struct qedf_dbg_ctx *qedf_dbg =
|
struct qedf_dbg_ctx *qedf_dbg =
|
||||||
|
@ -108,19 +111,25 @@ qedf_dbg_fp_int_cmd_read(struct file *filp, char __user *buffer, size_t count,
|
||||||
|
|
||||||
QEDF_INFO(qedf_dbg, QEDF_LOG_DEBUGFS, "entered\n");
|
QEDF_INFO(qedf_dbg, QEDF_LOG_DEBUGFS, "entered\n");
|
||||||
|
|
||||||
cnt = sprintf(buffer, "\nFastpath I/O completions\n\n");
|
cbuf = vmalloc(QEDF_DEBUGFS_LOG_LEN);
|
||||||
|
if (!cbuf)
|
||||||
|
return 0;
|
||||||
|
|
||||||
|
cnt += scnprintf(cbuf + cnt, QEDF_DEBUGFS_LOG_LEN - cnt, "\nFastpath I/O completions\n\n");
|
||||||
|
|
||||||
for (id = 0; id < qedf->num_queues; id++) {
|
for (id = 0; id < qedf->num_queues; id++) {
|
||||||
fp = &(qedf->fp_array[id]);
|
fp = &(qedf->fp_array[id]);
|
||||||
if (fp->sb_id == QEDF_SB_ID_NULL)
|
if (fp->sb_id == QEDF_SB_ID_NULL)
|
||||||
continue;
|
continue;
|
||||||
cnt += sprintf((buffer + cnt), "#%d: %lu\n", id,
|
cnt += scnprintf(cbuf + cnt, QEDF_DEBUGFS_LOG_LEN - cnt,
|
||||||
fp->completions);
|
"#%d: %lu\n", id, fp->completions);
|
||||||
}
|
}
|
||||||
|
|
||||||
cnt = min_t(int, count, cnt - *ppos);
|
ret = simple_read_from_buffer(buffer, count, ppos, cbuf, cnt);
|
||||||
*ppos += cnt;
|
|
||||||
return cnt;
|
vfree(cbuf);
|
||||||
|
|
||||||
|
return ret;
|
||||||
}
|
}
|
||||||
|
|
||||||
static ssize_t
|
static ssize_t
|
||||||
|
|
Loading…
Reference in a new issue