From owner-freebsd-net@FreeBSD.ORG Thu Jul 4 12:50:02 2013 Return-Path: Delivered-To: freebsd-net@smarthost.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) by hub.freebsd.org (Postfix) with ESMTP id 17D266E3 for ; Thu, 4 Jul 2013 12:50:02 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:1900:2254:206c::16:87]) by mx1.freebsd.org (Postfix) with ESMTP id E31501310 for ; Thu, 4 Jul 2013 12:50:01 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.7/8.14.7) with ESMTP id r64Co1k0052283 for ; Thu, 4 Jul 2013 12:50:01 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.7/8.14.7/Submit) id r64Co13m052282; Thu, 4 Jul 2013 12:50:01 GMT (envelope-from gnats) Date: Thu, 4 Jul 2013 12:50:01 GMT Message-Id: <201307041250.r64Co13m052282@freefall.freebsd.org> To: freebsd-net@FreeBSD.org Cc: From: Shahar Klein Subject: RE: kern/179999: [ofed] [patch] Bug assigning HCA from IB to ETH X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list Reply-To: Shahar Klein List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Jul 2013 12:50:02 -0000 The following reply was made to PR kern/179999; it has been noted by GNATS. From: Shahar Klein To: John Baldwin , "bug-followup@freebsd.org" Cc: Orit Moskovich , Oded Shanoon Subject: RE: kern/179999: [ofed] [patch] Bug assigning HCA from IB to ETH Date: Thu, 4 Jul 2013 12:34:09 +0000 Thanks John I've tested this version and it works fine. Shahar Klein -----Original Message----- From: John Baldwin [mailto:jhb@freebsd.org]=20 Sent: Friday, June 28, 2013 12:20 AM To: bug-followup@freebsd.org; Shahar Klein Subject: Re: kern/179999: [ofed] [patch] Bug assigning HCA from IB to ETH Thanks, I think the sysfs fix has a few issues though (it writes to buf[] e= ven if the copyin() fails, and it doesn't enforce a bounds check). It does= seem that this should probably be using sysctl_handle_string() instead of = doing it by hand, but for now I've just adjusted your patch. Can you pleas= e test this version? Index: ofed/drivers/net/mlx4/main.c =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D --- ofed/drivers/net/mlx4/main.c (revision 252306) +++ ofed/drivers/net/mlx4/main.c (working copy) @@ -479,11 +479,11 @@ int i; int err =3D 0; =20 - if (!strcmp(buf, "ib\n")) + if (!strcmp(buf, "ib")) info->tmp_type =3D MLX4_PORT_TYPE_IB; - else if (!strcmp(buf, "eth\n")) + else if (!strcmp(buf, "eth")) info->tmp_type =3D MLX4_PORT_TYPE_ETH; - else if (!strcmp(buf, "auto\n")) + else if (!strcmp(buf, "auto")) info->tmp_type =3D MLX4_PORT_TYPE_AUTO; else { mlx4_err(mdev, "%s is not supported port type\n", buf); Index: ofed/include/linux/sysfs.h =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D --- ofed/include/linux/sysfs.h (revision 252306) +++ ofed/include/linux/sysfs.h (working copy) @@ -104,10 +104,15 @@ error =3D SYSCTL_OUT(req, buf, len); if (error || !req->newptr || ops->store =3D=3D NULL) goto out; - error =3D SYSCTL_IN(req, buf, PAGE_SIZE); + len =3D req->newlen - req->newidx; + if (len >=3D PAGE_SIZE) + error =3D EINVAL; + else=20 + error =3D SYSCTL_IN(req, buf, len); if (error) goto out; - len =3D ops->store(kobj, attr, buf, req->newlen); + ((char *)buf)[len] =3D '\0'; + len =3D ops->store(kobj, attr, buf, len); if (len < 0) error =3D -len; out: -- John Baldwin