scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input

Malformed user input to debugfs results in buffer overflow crashes.  Adapt
input string lengths to fit within internal buffers, leaving space for NULL
terminators.

Link: https://lore.kernel.org/r/20220701211425.2708-3-jsmart2021@gmail.com
Co-developed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
index 7b24c932e8126a8e57d8eec4d700e2d98dc3fba6..25deacc92b02026563f08312b3bddaf3347236cd 100644 (file)
--- a/drivers/scsi/lpfc/lpfc_debugfs.c
+++ b/drivers/scsi/lpfc/lpfc_debugfs.c
@@ -2607,8 +2607,8 @@ lpfc_debugfs_multixripools_write(struct file *file, const char __user *buf,
        struct lpfc_sli4_hdw_queue *qp;
        struct lpfc_multixri_pool *multixri_pool;
 
-       if (nbytes > 64)
-               nbytes = 64;
+       if (nbytes > sizeof(mybuf) - 1)
+               nbytes = sizeof(mybuf) - 1;
 
        memset(mybuf, 0, sizeof(mybuf));
 
@@ -2688,8 +2688,8 @@ lpfc_debugfs_nvmestat_write(struct file *file, const char __user *buf,
        if (!phba->targetport)
                return -ENXIO;
 
-       if (nbytes > 64)
-               nbytes = 64;
+       if (nbytes > sizeof(mybuf) - 1)
+               nbytes = sizeof(mybuf) - 1;
 
        memset(mybuf, 0, sizeof(mybuf));
 
@@ -2826,8 +2826,8 @@ lpfc_debugfs_ioktime_write(struct file *file, const char __user *buf,
        char mybuf[64];
        char *pbuf;
 
-       if (nbytes > 64)
-               nbytes = 64;
+       if (nbytes > sizeof(mybuf) - 1)
+               nbytes = sizeof(mybuf) - 1;
 
        memset(mybuf, 0, sizeof(mybuf));
 
@@ -2954,8 +2954,8 @@ lpfc_debugfs_nvmeio_trc_write(struct file *file, const char __user *buf,
        char mybuf[64];
        char *pbuf;
 
-       if (nbytes > 63)
-               nbytes = 63;
+       if (nbytes > sizeof(mybuf) - 1)
+               nbytes = sizeof(mybuf) - 1;
 
        memset(mybuf, 0, sizeof(mybuf));
 
@@ -3060,8 +3060,8 @@ lpfc_debugfs_hdwqstat_write(struct file *file, const char __user *buf,
        char *pbuf;
        int i;
 
-       if (nbytes > 64)
-               nbytes = 64;
+       if (nbytes > sizeof(mybuf) - 1)
+               nbytes = sizeof(mybuf) - 1;
 
        memset(mybuf, 0, sizeof(mybuf));