ocs_fc: Fix config space bounds, double PRLI response and a stack overflowHEADmain

Fix three unrelated problems found by security review of the driver.

ECD helper ioctl:
- OCS_ECD_HELPER_CFG_READ* and OCS_ECD_HELPER_CFG_WRITE* passed a user
  supplied offset straight to pci_read_config() and pci_write_config().
  Reject accesses that extend past PCIE_REGMAX, so that a wide access
  starting in range cannot run past the end of config space.
- Use the real access width (1, 2 or 4 bytes) of the command for both
  the BAR and the config space checks, rather than assuming 4 bytes, so
  that narrow accesses at the very end of the BAR or config space are
  not rejected while wider ones remain bounded.

PRLI:
- When a PRLI carries an FC-4 type other than the one the driver
  supports, ocs_d_send_prli_rsp() sent an LS_RJT and started node
  shutdown, but then fell through and sent a second response on the same
  IO (another LS_RJT, or a PRLI LS_ACC when the initiator is accepted),
  followed by a conflicting transition to __ocs_d_device_ready.  The two
  responses posted two WQEs for one IO and caused a double ocs_ref_put(),
  a use after free of the ELS IO.  Return after dispatching the LS_RJT so
  that exactly one response is sent.
- __ocs_d_port_logged_in calls ocs_d_send_prli_rsp() without checking
  the FC-4 type, so any port that has completed a PLOGI can trigger this
  with a single PRLI, whether or not target mode is enabled.

Management:
- The active profile id is a uint32_t that is formatted as "0x%02x"
  with sprintf() into a buffer of MAX_PROFILE_LENGTH (5) bytes, which
  overflows for any id above 0xff.  Size the buffer for the longest
  possible string ("0x" plus 8 hex digits and the terminating NUL) and
  use ocs_snprintf().
- Use ocs_snprintf() for nv_wwpn as well, as nv_wwnn already does.

MFC after:	1 week
Sponsored by:	Broadcom
Reviewed by:	ken

0 files changed, 0 insertions, 0 deletions