Page MenuHomeFreeBSD

Fix a scribbler in the PMS driver.

Authored by dab on Feb 27 2019, 11:52 PM.



The ESGL bit was left uninitialized when executing the REPORT
LUNS ioctl. This could allow a zeroed data buffer to be treated as a
scatter/gather list. The firmware would eventually walk past the end
of the data buffer, potentially find what looked like a valid
address/length pair, and write the result to semi-random memory.

For Isilon folks, this is part of Anton's fix for bug 185562, PR
#2689, including his description above.

Test Plan

Code review. This code has been working in the Isilon
product for multiple releases (and the code before the change
definitely did /not/ work!).

Diff Detail

rS FreeBSD src repository
Automatic diff as part of commit; lint not applicable.
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

Minor whitespace cleanup.

This revision is now accepted and ready to land.Feb 28 2019, 5:29 PM

While I don't know what the hardware will do if these bits aren't cleared, this looks to me to implement the solution described in the commit message.

This revision was automatically updated to reflect the committed changes.

Looks like this already merged but looks good to me.

FWIW, when we first made this change I do believe we were able to test it on a fixed build where the scribbler would land somewhat reliably at a given address, by using the vendor provided utility to call this ioctl. It's simple enough to test the ioctl but obviously it's trickier to confirm the scribble or lack thereof unless you know where the data gets DMA'ed to to watch that memory.