Page MenuHomeFreeBSD

Fix a scribbler in the PMS driver.
ClosedPublic

Authored by dab on Feb 27 2019, 11:52 PM.
Tags
None
Referenced Files
Unknown Object (File)
Nov 14 2024, 10:13 PM
Unknown Object (File)
Oct 21 2024, 2:13 AM
Unknown Object (File)
Sep 27 2024, 8:33 PM
Unknown Object (File)
Sep 27 2024, 12:45 PM
Unknown Object (File)
Sep 18 2024, 11:00 PM
Unknown Object (File)
Sep 15 2024, 8:10 PM
Unknown Object (File)
Sep 5 2024, 7:59 AM
Unknown Object (File)
Sep 5 2024, 12:54 AM
Subscribers

Details

Summary

The ESGL bit was left uninitialized when executing the REPORT
LUNS ioctl. This could allow a zeroed data buffer to be treated as a
scatter/gather list. The firmware would eventually walk past the end
of the data buffer, potentially find what looked like a valid
address/length pair, and write the result to semi-random memory.

For Isilon folks, this is part of Anton's fix for bug 185562, PR
#2689, including his description above.

Test Plan

Code review. This code has been working in the Isilon
product for multiple releases (and the code before the change
definitely did /not/ work!).

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

Minor whitespace cleanup.

This revision is now accepted and ready to land.Feb 28 2019, 5:29 PM

While I don't know what the hardware will do if these bits aren't cleared, this looks to me to implement the solution described in the commit message.

This revision was automatically updated to reflect the committed changes.

Looks like this already merged but looks good to me.

FWIW, when we first made this change I do believe we were able to test it on a fixed build where the scribbler would land somewhat reliably at a given address, by using the vendor provided utility to call this ioctl. It's simple enough to test the ioctl but obviously it's trickier to confirm the scribble or lack thereof unless you know where the data gets DMA'ed to to watch that memory.