2d89a50f96
The sim_vid, hba_vid, and dev_name fields of struct ccb_pathinq are
fixed-length strings. AFAICT the only place they're read is in
sbin/camcontrol/camcontrol.c, which assumes they'll be null-terminated.
However, the kernel doesn't null-terminate them. A bunch of copy-pasted code
uses strncpy to write them, and doesn't guarantee null-termination. For at
least 4 drivers (mpr, mps, ciss, and hyperv), the hba_vid field actually
overflows. You can see the result by doing "camcontrol negotiate da0 -v".
This change null-terminates those fields everywhere they're set in the
kernel. It also shortens a few strings to ensure they'll fit within the
16-character field.
PR: 215474
Reported by: Coverity
CID: 1009997 1010000
|
||
---|---|---|
.. | ||
nvme_ctrlr_cmd.c | ||
nvme_ctrlr.c | ||
nvme_ns_cmd.c | ||
nvme_ns.c | ||
nvme_private.h | ||
nvme_qpair.c | ||
nvme_sim.c | ||
nvme_sysctl.c | ||
nvme_test.c | ||
nvme_util.c | ||
nvme.c | ||
nvme.h |