Page MenuHomeFreeBSD

Fix a scribbler in the PMS driver.
ClosedPublic

Authored by dab on Feb 27 2019, 11:52 PM.

Details

Summary

The ESGL bit was left uninitialized when executing the REPORT
LUNS ioctl. This could allow a zeroed data buffer to be treated as a
scatter/gather list. The firmware would eventually walk past the end
of the data buffer, potentially find what looked like a valid
address/length pair, and write the result to semi-random memory.

For Isilon folks, this is part of Anton's fix for bug 185562, PR
#2689, including his description above.

Test Plan

Code review. This code has been working in the Isilon
product for multiple releases (and the code before the change
definitely did /not/ work!).

Diff Detail

Repository
rS FreeBSD src repository
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

dab created this revision.Feb 27 2019, 11:52 PM
dab updated this revision to Diff 54511.Feb 28 2019, 12:10 AM

Minor whitespace cleanup.

rang_acm.org accepted this revision.Feb 28 2019, 5:29 PM
This revision is now accepted and ready to land.Feb 28 2019, 5:29 PM
imp accepted this revision.Feb 28 2019, 10:42 PM

While I don't know what the hardware will do if these bits aren't cleared, this looks to me to implement the solution described in the commit message.

This revision was automatically updated to reflect the committed changes.

Looks like this already merged but looks good to me.

FWIW, when we first made this change I do believe we were able to test it on a fixed build where the scribbler would land somewhat reliably at a given address, by using the vendor provided utility to call this ioctl. It's simple enough to test the ioctl but obviously it's trickier to confirm the scribble or lack thereof unless you know where the data gets DMA'ed to to watch that memory.