Commit 1683ce57 authored by Andrew Vasquez's avatar Andrew Vasquez Committed by Martin K. Petersen

scsi: qedi: Fix truncation of CHAP name and secret

The data in NVRAM is not guaranteed to be NUL terminated.  Since
snprintf expects byte-stream to accommodate null byte, the CHAP secret
is truncated.  Use sprintf instead of snprintf to fix the truncation of
CHAP name and secret.
Signed-off-by: default avatarAndrew Vasquez <andrew.vasquez@cavium.com>
Signed-off-by: default avatarNilesh Javali <nilesh.javali@cavium.com>
Reviewed-by: default avatarBart Van Assche <bart.vanassche@wdc.com>
Acked-by: default avatarChris Leech <cleech@redhat.com>
Acked-by: default avatarLee Duncan <lduncan@suse.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent f3767225
...@@ -1830,8 +1830,8 @@ static ssize_t qedi_show_boot_ini_info(void *data, int type, char *buf) ...@@ -1830,8 +1830,8 @@ static ssize_t qedi_show_boot_ini_info(void *data, int type, char *buf)
switch (type) { switch (type) {
case ISCSI_BOOT_INI_INITIATOR_NAME: case ISCSI_BOOT_INI_INITIATOR_NAME:
rc = snprintf(str, NVM_ISCSI_CFG_ISCSI_NAME_MAX_LEN, "%s\n", rc = sprintf(str, "%.*s\n", NVM_ISCSI_CFG_ISCSI_NAME_MAX_LEN,
initiator->initiator_name.byte); initiator->initiator_name.byte);
break; break;
default: default:
rc = 0; rc = 0;
...@@ -1898,8 +1898,8 @@ qedi_show_boot_tgt_info(struct qedi_ctx *qedi, int type, ...@@ -1898,8 +1898,8 @@ qedi_show_boot_tgt_info(struct qedi_ctx *qedi, int type,
switch (type) { switch (type) {
case ISCSI_BOOT_TGT_NAME: case ISCSI_BOOT_TGT_NAME:
rc = snprintf(str, NVM_ISCSI_CFG_ISCSI_NAME_MAX_LEN, "%s\n", rc = sprintf(str, "%.*s\n", NVM_ISCSI_CFG_ISCSI_NAME_MAX_LEN,
block->target[idx].target_name.byte); block->target[idx].target_name.byte);
break; break;
case ISCSI_BOOT_TGT_IP_ADDR: case ISCSI_BOOT_TGT_IP_ADDR:
if (ipv6_en) if (ipv6_en)
...@@ -1920,20 +1920,20 @@ qedi_show_boot_tgt_info(struct qedi_ctx *qedi, int type, ...@@ -1920,20 +1920,20 @@ qedi_show_boot_tgt_info(struct qedi_ctx *qedi, int type,
block->target[idx].lun.value[0]); block->target[idx].lun.value[0]);
break; break;
case ISCSI_BOOT_TGT_CHAP_NAME: case ISCSI_BOOT_TGT_CHAP_NAME:
rc = snprintf(str, NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN, "%s\n", rc = sprintf(str, "%.*s\n", NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN,
chap_name); chap_name);
break; break;
case ISCSI_BOOT_TGT_CHAP_SECRET: case ISCSI_BOOT_TGT_CHAP_SECRET:
rc = snprintf(str, NVM_ISCSI_CFG_CHAP_PWD_MAX_LEN, "%s\n", rc = sprintf(str, "%.*s\n", NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN,
chap_secret); chap_secret);
break; break;
case ISCSI_BOOT_TGT_REV_CHAP_NAME: case ISCSI_BOOT_TGT_REV_CHAP_NAME:
rc = snprintf(str, NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN, "%s\n", rc = sprintf(str, "%.*s\n", NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN,
mchap_name); mchap_name);
break; break;
case ISCSI_BOOT_TGT_REV_CHAP_SECRET: case ISCSI_BOOT_TGT_REV_CHAP_SECRET:
rc = snprintf(str, NVM_ISCSI_CFG_CHAP_PWD_MAX_LEN, "%s\n", rc = sprintf(str, "%.*s\n", NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN,
mchap_secret); mchap_secret);
break; break;
case ISCSI_BOOT_TGT_FLAGS: case ISCSI_BOOT_TGT_FLAGS:
rc = snprintf(str, 3, "%hhd\n", SYSFS_FLAG_FW_SEL_BOOT); rc = snprintf(str, 3, "%hhd\n", SYSFS_FLAG_FW_SEL_BOOT);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment