Page Menu
Home
FreeBSD
Search
Configure Global Search
Log In
Files
F137067740
D6496.diff
No One
Temporary
Actions
View File
Edit File
Delete File
View Transforms
Subscribe
Mute Notifications
Flag For Later
Award Token
Size
14 KB
Referenced Files
None
Subscribers
None
D6496.diff
View Options
Index: head/lib/libcam/camlib.c
===================================================================
--- head/lib/libcam/camlib.c
+++ head/lib/libcam/camlib.c
@@ -619,7 +619,7 @@
/*
* Zero the payload, the kernel does look at the flags.
*/
- bzero(&(&ccb.ccb_h)[1], sizeof(struct ccb_trans_settings));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb.cts);
/*
* Get transfer settings for this device.
Index: head/sbin/camcontrol/attrib.c
===================================================================
--- head/sbin/camcontrol/attrib.c
+++ head/sbin/camcontrol/attrib.c
@@ -137,8 +137,7 @@
goto bailout;
}
- bzero(&(&ccb->ccb_h)[1],
- sizeof(union ccb) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->csio);
STAILQ_INIT(&write_attr_list);
Index: head/sbin/camcontrol/camcontrol.c
===================================================================
--- head/sbin/camcontrol/camcontrol.c
+++ head/sbin/camcontrol/camcontrol.c
@@ -842,8 +842,7 @@
}
/* cam_getccb cleans up the header, caller has to zero the payload */
- bzero(&(&ccb->ccb_h)[1],
- sizeof(struct ccb_scsiio) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->csio);
inq_buf = (struct scsi_inquiry_data *)malloc(
sizeof(struct scsi_inquiry_data));
@@ -958,8 +957,7 @@
}
/* cam_getccb cleans up the header, caller has to zero the payload */
- bzero(&(&ccb->ccb_h)[1],
- sizeof(struct ccb_scsiio) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->csio);
serial_buf = (struct scsi_vpd_unit_serial_number *)
malloc(sizeof(*serial_buf));
@@ -1051,8 +1049,7 @@
return(1);
}
- bzero(&(&ccb->ccb_h)[1],
- sizeof(struct ccb_trans_settings) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->cts);
ccb->ccb_h.func_code = XPT_GET_TRAN_SETTINGS;
ccb->cts.type = CTS_TYPE_CURRENT_SETTINGS;
@@ -1605,8 +1602,7 @@
ata_flags |= AP_FLAG_TLEN_NO_DATA;
}
- bzero(&(&ccb->ccb_h)[1],
- sizeof(struct ccb_scsiio) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->csio);
scsi_ata_pass_16(&ccb->csio,
retries,
@@ -1667,8 +1663,7 @@
timeout, quiet);
}
- bzero(&(&ccb->ccb_h)[1], sizeof(struct ccb_ataio) -
- sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->ataio);
cam_fill_ataio(&ccb->ataio,
retries,
NULL,
@@ -1737,8 +1732,7 @@
return (error);
}
- bzero(&(&ccb->ccb_h)[1], sizeof(struct ccb_ataio) -
- sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->ataio);
cam_fill_ataio(&ccb->ataio,
retries,
NULL,
@@ -3187,8 +3181,7 @@
* no-op, sending a rescan to the xpt bus would result in a status of
* CAM_REQ_INVALID.
*/
- bzero(&(&matchccb.ccb_h)[1],
- sizeof(struct ccb_dev_match) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&matchccb.cdm);
matchccb.ccb_h.func_code = XPT_DEV_MATCH;
matchccb.ccb_h.path_id = CAM_BUS_WILDCARD;
bufsize = sizeof(struct dev_match_result) * 20;
@@ -3536,8 +3529,7 @@
* cam_getccb() zeros the CCB header only. So we need to zero the
* payload portion of the ccb.
*/
- bzero(&(&ccb->ccb_h)[1],
- sizeof(struct ccb_scsiio) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->csio);
scsi_read_defects(&ccb->csio,
/*retries*/ retry_count,
@@ -3990,8 +3982,7 @@
if (ccb == NULL)
errx(1, "mode_sense: couldn't allocate CCB");
- bzero(&(&ccb->ccb_h)[1],
- sizeof(struct ccb_scsiio) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->csio);
scsi_mode_sense(&ccb->csio,
/* retries */ retry_count,
@@ -4040,8 +4031,7 @@
if (ccb == NULL)
errx(1, "mode_select: couldn't allocate CCB");
- bzero(&(&ccb->ccb_h)[1],
- sizeof(struct ccb_scsiio) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->csio);
scsi_mode_select(&ccb->csio,
/* retries */ retry_count,
@@ -4158,8 +4148,7 @@
return(1);
}
- bzero(&(&ccb->ccb_h)[1],
- sizeof(union ccb) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(ccb);
while ((c = getopt(argc, argv, combinedopt)) != -1) {
switch(c) {
@@ -4660,8 +4649,7 @@
cam_path_string(device, pathstr, sizeof(pathstr));
if (numtags >= 0) {
- bzero(&(&ccb->ccb_h)[1],
- sizeof(struct ccb_relsim) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->crs);
ccb->ccb_h.func_code = XPT_REL_SIMQ;
ccb->ccb_h.flags = CAM_DEV_QFREEZE;
ccb->crs.release_flags = RELSIM_ADJUST_OPENINGS;
@@ -4688,8 +4676,7 @@
pathstr, ccb->crs.openings);
}
- bzero(&(&ccb->ccb_h)[1],
- sizeof(struct ccb_getdevstats) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->cgds);
ccb->ccb_h.func_code = XPT_GDEV_STATS;
@@ -4889,8 +4876,7 @@
warnx("get_cpi: couldn't allocate CCB");
return(1);
}
- bzero(&(&ccb->ccb_h)[1],
- sizeof(struct ccb_pathinq) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->cpi);
ccb->ccb_h.func_code = XPT_PATH_INQ;
if (cam_send_ccb(device, ccb) < 0) {
warn("get_cpi: error sending Path Inquiry CCB");
@@ -4928,8 +4914,7 @@
warnx("get_cgd: couldn't allocate CCB");
return(1);
}
- bzero(&(&ccb->ccb_h)[1],
- sizeof(struct ccb_pathinq) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->cgd);
ccb->ccb_h.func_code = XPT_GDEV_TYPE;
if (cam_send_ccb(device, ccb) < 0) {
warn("get_cgd: error sending Path Inquiry CCB");
@@ -4974,8 +4959,7 @@
}
/* cam_getccb cleans up the header, caller has to zero the payload */
- bzero(&(&ccb->ccb_h)[1],
- sizeof(struct ccb_scsiio) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->csio);
bzero(&sup_pages, sizeof(sup_pages));
@@ -5449,8 +5433,7 @@
return(1);
}
- bzero(&(&ccb->ccb_h)[1],
- sizeof(struct ccb_trans_settings) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->cts);
ccb->ccb_h.func_code = XPT_GET_TRAN_SETTINGS;
@@ -5590,8 +5573,7 @@
break;
}
}
- bzero(&(&ccb->ccb_h)[1],
- sizeof(struct ccb_pathinq) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->cpi);
/*
* Grab path inquiry information, so we can determine whether
* or not the initiator is capable of the things that the user
@@ -5617,8 +5599,7 @@
goto ratecontrol_bailout;
}
bcopy(&ccb->cpi, &cpi, sizeof(struct ccb_pathinq));
- bzero(&(&ccb->ccb_h)[1],
- sizeof(struct ccb_trans_settings) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->cts);
if (quiet == 0) {
fprintf(stdout, "%s parameters:\n",
user_settings ? "User" : "Current");
@@ -5871,8 +5852,7 @@
return(1);
}
- bzero(&(&ccb->ccb_h)[1],
- sizeof(struct ccb_scsiio) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->csio);
while ((c = getopt(argc, argv, combinedopt)) != -1) {
switch(c) {
@@ -6020,8 +6000,7 @@
do {
cam_status status;
- bzero(&(&ccb->ccb_h)[1],
- sizeof(struct ccb_scsiio) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->csio);
/*
* There's really no need to do error recovery or
@@ -6168,8 +6147,7 @@
return(1);
}
- bzero(&(&ccb->ccb_h)[1],
- sizeof(struct ccb_scsiio) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->csio);
while ((c = getopt(argc, argv, combinedopt)) != -1) {
switch(c) {
@@ -6430,8 +6408,7 @@
do {
cam_status status;
- bzero(&(&ccb->ccb_h)[1],
- sizeof(struct ccb_scsiio) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->csio);
/*
* There's really no need to do error recovery or
@@ -6573,8 +6550,7 @@
return (1);
}
- bzero(&(&ccb->ccb_h)[1],
- sizeof(struct ccb_scsiio) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->csio);
countonly = 0;
lunsonly = 0;
@@ -6822,8 +6798,7 @@
return (1);
}
- bzero(&(&ccb->ccb_h)[1],
- sizeof(struct ccb_scsiio) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->csio);
while ((c = getopt(argc, argv, combinedopt)) != -1) {
switch (c) {
@@ -7027,8 +7002,7 @@
return (1);
}
- bzero(&(&ccb->ccb_h)[1],
- sizeof(union ccb) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->smpio);
while ((c = getopt(argc, argv, combinedopt)) != -1) {
switch (c) {
@@ -7221,8 +7195,7 @@
return (1);
}
- bzero(&(&ccb->ccb_h)[1],
- sizeof(union ccb) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->smpio);
while ((c = getopt(argc, argv, combinedopt)) != -1) {
switch (c) {
@@ -7284,8 +7257,7 @@
if ((response->long_response & SMP_RG_LONG_RESPONSE)
&& (long_response == 0)) {
ccb->ccb_h.status = CAM_REQ_INPROG;
- bzero(&(&ccb->ccb_h)[1],
- sizeof(union ccb) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->smpio);
long_response = 1;
goto try_long;
}
@@ -7367,8 +7339,7 @@
return (1);
}
- bzero(&(&ccb->ccb_h)[1],
- sizeof(union ccb) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->smpio);
while ((c = getopt(argc, argv, combinedopt)) != -1) {
switch (c) {
@@ -7625,8 +7596,7 @@
return (1);
}
- bzero(&(&ccb->ccb_h)[1],
- sizeof(union ccb) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->smpio);
while ((c = getopt(argc, argv, combinedopt)) != -1) {
switch (c) {
@@ -7720,8 +7690,7 @@
goto bailout;
}
- bzero(&(&ccb->ccb_h)[1],
- sizeof(union ccb) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->cdai);
/*
* On the first try, we just probe for the size of the data, and
@@ -8006,8 +7975,7 @@
return (1);
}
- bzero(&(&ccb->ccb_h)[1],
- sizeof(union ccb) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->smpio);
STAILQ_INIT(&devlist.dev_queue);
rgrequest = malloc(sizeof(*rgrequest));
@@ -8111,8 +8079,7 @@
char tmpstr[256];
int j;
- bzero(&(&ccb->ccb_h)[1],
- sizeof(union ccb) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->smpio);
ccb->ccb_h.status = CAM_REQ_INPROG;
ccb->ccb_h.flags |= CAM_DEV_QFRZDIS;
@@ -8401,8 +8368,7 @@
}
/* cam_getccb cleans up the header, caller has to zero the payload */
- bzero(&(&ccb->ccb_h)[1],
- sizeof(struct ccb_scsiio) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->csio);
if (opcode_set != 0) {
options |= RSO_OPTIONS_OC;
@@ -8841,8 +8807,7 @@
return (1);
}
- bzero(&(&ccb->ccb_h)[1],
- sizeof(struct ccb_scsiio) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->csio);
ccb->ccb_h.func_code = XPT_REPROBE_LUN;
Index: head/sbin/camcontrol/fwdownload.c
===================================================================
--- head/sbin/camcontrol/fwdownload.c
+++ head/sbin/camcontrol/fwdownload.c
@@ -459,8 +459,7 @@
}
/* cam_getccb cleans up the header, caller has to zero the payload */
- bzero(&(&ccb->ccb_h)[1],
- sizeof(struct ccb_scsiio) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->csio);
bzero(&vpd_page, sizeof(vpd_page));
@@ -666,8 +665,7 @@
goto bailout;
}
- bzero(&(&ccb->ccb_h)[1],
- sizeof(union ccb) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(ccb);
if (devtype != CC_DT_SCSI) {
dxfer_len = sizeof(struct ata_params);
@@ -798,8 +796,7 @@
goto bailout;
}
- bzero(&(&ccb->ccb_h)[1],
- sizeof(union ccb) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(ccb);
max_pkt_size = vp->max_pkt_size;
if (max_pkt_size == 0)
@@ -830,8 +827,7 @@
vp->cdb_byte2;
cdb.buffer_id = vp->inc_cdb_buffer_id ? pkt_count : 0;
/* Zero out payload of ccb union after ccb header. */
- bzero(&(&ccb->ccb_h)[1],
- sizeof(struct ccb_scsiio) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->csio);
/*
* Copy previously constructed cdb into ccb_scsiio
* struct.
Index: head/sbin/camcontrol/persist.c
===================================================================
--- head/sbin/camcontrol/persist.c
+++ head/sbin/camcontrol/persist.c
@@ -450,8 +450,7 @@
goto bailout;
}
- bzero(&(&ccb->ccb_h)[1],
- sizeof(union ccb) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->csio);
while ((c = getopt(argc, argv, combinedopt)) != -1) {
switch (c) {
Index: head/sbin/iscontrol/fsm.c
===================================================================
--- head/sbin/iscontrol/fsm.c
+++ head/sbin/iscontrol/fsm.c
@@ -372,7 +372,7 @@
debug(2, "pathstr=%s", pathstr);
ccb = cam_getccb(sess->camdev);
- bzero(&(&ccb->ccb_h)[1], sizeof(struct ccb_relsim) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->crs);
ccb->ccb_h.func_code = XPT_REL_SIMQ;
ccb->crs.release_flags = RELSIM_ADJUST_OPENINGS;
ccb->crs.openings = sess->op->tags;
Index: head/sys/cam/cam_ccb.h
===================================================================
--- head/sys/cam/cam_ccb.h
+++ head/sys/cam/cam_ccb.h
@@ -1230,6 +1230,10 @@
struct ccb_async casync;
};
+#define CCB_CLEAR_ALL_EXCEPT_HDR(ccbp) \
+ bzero((char *)(ccbp) + sizeof((ccbp)->ccb_h), \
+ sizeof(*(ccbp)) - sizeof((ccbp)->ccb_h))
+
__BEGIN_DECLS
static __inline void
cam_fill_csio(struct ccb_scsiio *csio, u_int32_t retries,
Index: head/usr.sbin/camdd/camdd.c
===================================================================
--- head/usr.sbin/camdd/camdd.c
+++ head/usr.sbin/camdd/camdd.c
@@ -1305,8 +1305,7 @@
goto bailout;
}
- bzero(&(&ccb->ccb_h)[1],
- sizeof(struct ccb_scsiio) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->csio);
scsi_read_capacity(&ccb->csio,
/*retries*/ probe_retry_count,
@@ -1387,8 +1386,7 @@
goto bailout_error;
}
- bzero(&(&ccb->ccb_h)[1],
- sizeof(struct ccb_scsiio) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->cpi);
ccb->ccb_h.func_code = XPT_PATH_INQ;
ccb->ccb_h.flags = CAM_DIR_NONE;
@@ -2439,8 +2437,7 @@
data = &buf->buf_type_spec.data;
ccb = &data->ccb;
- bzero(&(&ccb->ccb_h)[1],
- sizeof(struct ccb_scsiio) - sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->csio);
/*
* In almost every case the number of blocks should be the device
Index: head/usr.sbin/mptutil/mpt_cam.c
===================================================================
--- head/usr.sbin/mptutil/mpt_cam.c
+++ head/usr.sbin/mptutil/mpt_cam.c
@@ -241,8 +241,7 @@
return (ENOMEM);
/* Zero the rest of the ccb. */
- bzero(&(&ccb->ccb_h)[1], sizeof(struct ccb_scsiio) -
- sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->csio);
scsi_read_capacity(&ccb->csio, 1, NULL, MSG_SIMPLE_Q_TAG, &rcap,
SSD_FULL_SIZE, 5000);
@@ -273,8 +272,7 @@
}
/* Zero the rest of the ccb. */
- bzero(&(&ccb->ccb_h)[1], sizeof(struct ccb_scsiio) -
- sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->csio);
scsi_read_capacity_16(&ccb->csio, 1, NULL, MSG_SIMPLE_Q_TAG, 0, 0, 0,
(uint8_t *)&rcaplong, sizeof(rcaplong), SSD_FULL_SIZE, 5000);
@@ -355,8 +353,7 @@
return (ENOMEM);
/* Zero the rest of the ccb. */
- bzero(&(&ccb->ccb_h)[1], sizeof(struct ccb_scsiio) -
- sizeof(struct ccb_hdr));
+ CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->csio);
inq_buf = calloc(1, sizeof(*inq_buf));
if (inq_buf == NULL) {
File Metadata
Details
Attached
Mime Type
text/plain
Expires
Sat, Nov 22, 2:09 AM (22 h, 32 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
25870022
Default Alt Text
D6496.diff (14 KB)
Attached To
Mode
D6496: Fix multiple Coverity CWE-119 (Out-of-bounds access) errors in userland CAM code
Attached
Detach File
Event Timeline
Log In to Comment