Page MenuHomeFreeBSD

Fix a scribbler in the PMS driver.
ClosedPublic

Authored by dab on Feb 27 2019, 11:52 PM.
Tags
None
Referenced Files
Unknown Object (File)
Feb 15 2024, 1:52 AM
Unknown Object (File)
Jan 10 2024, 1:46 PM
Unknown Object (File)
Dec 29 2023, 1:44 AM
Unknown Object (File)
Dec 23 2023, 8:17 AM
Unknown Object (File)
Dec 22 2023, 6:35 AM
Unknown Object (File)
Dec 21 2023, 8:41 PM
Unknown Object (File)
Dec 20 2023, 2:08 AM
Unknown Object (File)
Dec 12 2023, 6:34 PM
Subscribers

Details

Summary

The ESGL bit was left uninitialized when executing the REPORT
LUNS ioctl. This could allow a zeroed data buffer to be treated as a
scatter/gather list. The firmware would eventually walk past the end
of the data buffer, potentially find what looked like a valid
address/length pair, and write the result to semi-random memory.

For Isilon folks, this is part of Anton's fix for bug 185562, PR
#2689, including his description above.

Test Plan

Code review. This code has been working in the Isilon
product for multiple releases (and the code before the change
definitely did /not/ work!).

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

Minor whitespace cleanup.

This revision is now accepted and ready to land.Feb 28 2019, 5:29 PM

While I don't know what the hardware will do if these bits aren't cleared, this looks to me to implement the solution described in the commit message.

This revision was automatically updated to reflect the committed changes.

Looks like this already merged but looks good to me.

FWIW, when we first made this change I do believe we were able to test it on a fixed build where the scribbler would land somewhat reliably at a given address, by using the vendor provided utility to call this ioctl. It's simple enough to test the ioctl but obviously it's trickier to confirm the scribble or lack thereof unless you know where the data gets DMA'ed to to watch that memory.