Fixed unbounded firmware revision string from port caused the system panic (CR 126560)

Oracle bug 13709784
Oracle bugzilla 13352
02/10/2012
Chuck Anderson

Patch Emulex LPFC device driver to 8.3.5.58.2p

commit comment:
lpfc 8.3.29: SLI related fixes.
Fix unbounded firmware revision string from port cause panic (126560)

Signed-off-by: Chuck Anderson <chuck.anderson@oracle.com>

diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
index 17aaec9420cb558a186b08f866a8d55d4cb9b99c..d8e03c44a2a517a182bffd04a81a3dcd918c67b9 100644 (file)
--- a/drivers/scsi/lpfc/lpfc_attr.c
+++ b/drivers/scsi/lpfc/lpfc_attr.c
@@ -351,7 +351,7 @@ lpfc_fwrev_show(struct device *dev, struct device_attribute *attr,
        struct lpfc_hba   *phba = vport->phba;
        uint32_t if_type;
        uint8_t sli_family;
-       char fwrev[32];
+       char fwrev[FW_REV_STR_SIZE];
        int len;
 
        lpfc_decode_firmware_rev(phba, fwrev, 1);

diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c
index 707081d0a2265ad88e7d4b18c25ca0d51d2a9998..93e96b3c9097aff51694c6f7cc6f35dd695deead 100644 (file)
--- a/drivers/scsi/lpfc/lpfc_ct.c
+++ b/drivers/scsi/lpfc/lpfc_ct.c
@@ -1076,7 +1076,7 @@ int
 lpfc_vport_symbolic_node_name(struct lpfc_vport *vport, char *symbol,
        size_t size)
 {
-       char fwrev[16];
+       char fwrev[FW_REV_STR_SIZE];
        int n;
 
        lpfc_decode_firmware_rev(vport->phba, fwrev, 0);
@@ -1834,7 +1834,7 @@ lpfc_decode_firmware_rev(struct lpfc_hba *phba, char *fwrevision, int flag)
        uint8_t *fwname;
 
        if (phba->sli_rev == LPFC_SLI_REV4)
-               sprintf(fwrevision, "%s", vp->rev.opFwName);
+               snprintf(fwrevision, FW_REV_STR_SIZE, "%s", vp->rev.opFwName);
        else if (vp->rev.rBit) {
                if (psli->sli_flag & LPFC_SLI_ACTIVE)
                        rev = vp->rev.sli2FwRev;

diff --git a/drivers/scsi/lpfc/lpfc_hw.h b/drivers/scsi/lpfc/lpfc_hw.h
index 7245bead3755a03fd3e2f17a1d65034b1b98d348..c3289077e04aa2ffb1ef5b227c10ebb6392db453 100644 (file)
--- a/drivers/scsi/lpfc/lpfc_hw.h
+++ b/drivers/scsi/lpfc/lpfc_hw.h
@@ -70,6 +70,7 @@
 /* vendor ID used in SCSI netlink calls */
 #define LPFC_NL_VENDOR_ID (SCSI_NL_VID_TYPE_PCI | PCI_VENDOR_ID_EMULEX)
 
+#define FW_REV_STR_SIZE        32
 /* Common Transport structures and definitions */
 
 union CtRevisionId {

diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 8ba4b5e0f933522383f90f9a2c93656c478a165a..1bf4412ed4ea3cc2b9d89af14430f950f756f8af 100644 (file)
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -9045,7 +9045,7 @@ lpfc_sli4_get_els_iocb_cnt(struct lpfc_hba *phba)
 int
 lpfc_write_firmware(struct lpfc_hba *phba, const struct firmware *fw)
 {
-       char fwrev[32];
+       char fwrev[FW_REV_STR_SIZE];
        struct lpfc_grp_hdr *image = (struct lpfc_grp_hdr *)fw->data;
        struct list_head dma_buffer_list;
        int i, rc = 0;