LinuxLists.cc - [PATCH 0/3] lightnvm: small fixes

2017-04-11 14:20:08

Subject: [PATCH 0/3] lightnvm: small fixes

Last small lightnvm fixes for lightnvm core. These are motivated by
Bart's comments on pblk's patch.

Javier González (3):
lightnvm: clean unused variable
lightnvm: fix type checks on rrpc
lightnvm: convert sprintf into strlcpy

drivers/lightnvm/core.c | 9 +++------
drivers/lightnvm/rrpc.c | 4 ++--
2 files changed, 5 insertions(+), 8 deletions(-)

--
2.7.4

2017-04-11 14:19:11

by Javier González

[permalink] [raw]

Subject: [PATCH] lightnvm: convert sprintf into strlcpy

Convert sprintf calls to strlcpy in order to make possible buffer
overflow more obvious.

Signed-off-by: Javier González <[email protected]>
---
drivers/lightnvm/core.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/lightnvm/core.c b/drivers/lightnvm/core.c
index 258007a..2c26af3 100644
--- a/drivers/lightnvm/core.c
+++ b/drivers/lightnvm/core.c
@@ -273,7 +273,7 @@ static int nvm_create_tgt(struct nvm_dev *dev, struct nvm_ioctl_create *create)
goto err_disk;
blk_queue_make_request(tqueue, tt->make_rq);

- sprintf(tdisk->disk_name, "%s", create->tgtname);
+ strlcpy(tdisk->disk_name, create->tgtname, sizeof(tdisk->disk_name));
tdisk->flags = GENHD_FL_EXT_DEVT;
tdisk->major = 0;
tdisk->first_minor = 0;
@@ -1198,13 +1198,13 @@ static long nvm_ioctl_get_devices(struct file *file, void __user *arg)
list_for_each_entry(dev, &nvm_devices, devices) {
struct nvm_ioctl_device_info *info = &devices->info[i];

- sprintf(info->devname, "%s", dev->name);
+ strlcpy(info->devname, dev->name, sizeof(info->devname));

/* kept for compatibility */
info->bmversion[0] = 1;
info->bmversion[1] = 0;
info->bmversion[2] = 0;
- sprintf(info->bmname, "%s", "gennvm");
+ strlcpy(info->bmname, "gennvm", sizeof(info->bmname));
i++;

if (i > 31) {
--
2.7.4

2017-04-11 14:19:17

by Javier González

[permalink] [raw]

Subject: [PATCH 2/3] lightnvm: fix type checks on rrpc

sector_t is always unsigned, therefore avoid < 0 checks on it.

Signed-off-by: Javier González <[email protected]>
---
drivers/lightnvm/rrpc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/lightnvm/rrpc.c b/drivers/lightnvm/rrpc.c
index 5dba544..cf0e28a 100644
--- a/drivers/lightnvm/rrpc.c
+++ b/drivers/lightnvm/rrpc.c
@@ -817,7 +817,7 @@ static int rrpc_read_ppalist_rq(struct rrpc *rrpc, struct bio *bio,

for (i = 0; i < npages; i++) {
/* We assume that mapping occurs at 4KB granularity */
- BUG_ON(!(laddr + i >= 0 && laddr + i < rrpc->nr_sects));
+ BUG_ON(!(laddr + i < rrpc->nr_sects));
gp = &rrpc->trans_map[laddr + i];

if (gp->rblk) {
@@ -846,7 +846,7 @@ static int rrpc_read_rq(struct rrpc *rrpc, struct bio *bio, struct nvm_rq *rqd,
if (!is_gc && rrpc_lock_rq(rrpc, bio, rqd))
return NVM_IO_REQUEUE;

- BUG_ON(!(laddr >= 0 && laddr < rrpc->nr_sects));
+ BUG_ON(!(laddr < rrpc->nr_sects));
gp = &rrpc->trans_map[laddr];

if (gp->rblk) {
--
2.7.4

2017-04-11 14:19:15

by Javier González

[permalink] [raw]

Subject: [PATCH 1/3] lightnvm: clean unused variable

Clean unused variable on lightnvm core.

Signed-off-by: Javier González <[email protected]>
---
drivers/lightnvm/core.c | 3 ---
1 file changed, 3 deletions(-)

diff --git a/drivers/lightnvm/core.c b/drivers/lightnvm/core.c
index eb9ab1a..258007a 100644
--- a/drivers/lightnvm/core.c
+++ b/drivers/lightnvm/core.c
@@ -501,7 +501,6 @@ void nvm_part_to_tgt(struct nvm_dev *dev, sector_t *entries,
int *lun_roffs;
struct ppa_addr gaddr;
u64 pba = le64_to_cpu(entries[i]);
- int off;
u64 diff;

if (!pba)
@@ -511,8 +510,6 @@ void nvm_part_to_tgt(struct nvm_dev *dev, sector_t *entries,
ch_rmap = &dev_rmap->chnls[gaddr.g.ch];
lun_roffs = ch_rmap->lun_offs;

- off = gaddr.g.ch * geo->luns_per_chnl + gaddr.g.lun;
-
diff = ((ch_rmap->ch_off * geo->luns_per_chnl) +
(lun_roffs[gaddr.g.lun])) * geo->sec_per_lun;

--
2.7.4

2017-04-11 14:20:05

by Javier González

[permalink] [raw]

Subject: [PATCH 3/3] lightnvm: convert sprintf into strlcpy

2017-04-11 14:35:21

by Matias Bjørling

[permalink] [raw]

Subject: Re: [PATCH 1/3] lightnvm: clean unused variable

On 04/11/2017 04:18 PM, Javier González wrote:
> Clean unused variable on lightnvm core.
>
> Signed-off-by: Javier González <[email protected]>
> ---
> drivers/lightnvm/core.c | 3 ---
> 1 file changed, 3 deletions(-)
>
> diff --git a/drivers/lightnvm/core.c b/drivers/lightnvm/core.c
> index eb9ab1a..258007a 100644
> --- a/drivers/lightnvm/core.c
> +++ b/drivers/lightnvm/core.c
> @@ -501,7 +501,6 @@ void nvm_part_to_tgt(struct nvm_dev *dev, sector_t *entries,
> int *lun_roffs;
> struct ppa_addr gaddr;
> u64 pba = le64_to_cpu(entries[i]);
> - int off;
> u64 diff;
>
> if (!pba)
> @@ -511,8 +510,6 @@ void nvm_part_to_tgt(struct nvm_dev *dev, sector_t *entries,
> ch_rmap = &dev_rmap->chnls[gaddr.g.ch];
> lun_roffs = ch_rmap->lun_offs;
>
> - off = gaddr.g.ch * geo->luns_per_chnl + gaddr.g.lun;
> -
> diff = ((ch_rmap->ch_off * geo->luns_per_chnl) +
> (lun_roffs[gaddr.g.lun])) * geo->sec_per_lun;
>
>
Thanks. Applied for 4.12.

2017-04-11 14:35:35

by Matias Bjørling

[permalink] [raw]

Subject: Re: [PATCH 2/3] lightnvm: fix type checks on rrpc

On 04/11/2017 04:18 PM, Javier González wrote:
> sector_t is always unsigned, therefore avoid < 0 checks on it.
>
> Signed-off-by: Javier González <[email protected]>
> ---
> drivers/lightnvm/rrpc.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/lightnvm/rrpc.c b/drivers/lightnvm/rrpc.c
> index 5dba544..cf0e28a 100644
> --- a/drivers/lightnvm/rrpc.c
> +++ b/drivers/lightnvm/rrpc.c
> @@ -817,7 +817,7 @@ static int rrpc_read_ppalist_rq(struct rrpc *rrpc, struct bio *bio,
>
> for (i = 0; i < npages; i++) {
> /* We assume that mapping occurs at 4KB granularity */
> - BUG_ON(!(laddr + i >= 0 && laddr + i < rrpc->nr_sects));
> + BUG_ON(!(laddr + i < rrpc->nr_sects));
> gp = &rrpc->trans_map[laddr + i];
>
> if (gp->rblk) {
> @@ -846,7 +846,7 @@ static int rrpc_read_rq(struct rrpc *rrpc, struct bio *bio, struct nvm_rq *rqd,
> if (!is_gc && rrpc_lock_rq(rrpc, bio, rqd))
> return NVM_IO_REQUEUE;
>
> - BUG_ON(!(laddr >= 0 && laddr < rrpc->nr_sects));
> + BUG_ON(!(laddr < rrpc->nr_sects));
> gp = &rrpc->trans_map[laddr];
>
> if (gp->rblk) {
>
Thanks. Applied for 4.12.

2017-04-11 14:36:01

by Matias Bjørling

[permalink] [raw]

Subject: Re: [PATCH 3/3] lightnvm: convert sprintf into strlcpy

On 04/11/2017 04:18 PM, Javier González wrote:
> Convert sprintf calls to strlcpy in order to make possible buffer
> overflow more obvious.
>
> Signed-off-by: Javier González <[email protected]>
> ---
> drivers/lightnvm/core.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/lightnvm/core.c b/drivers/lightnvm/core.c
> index 258007a..2c26af3 100644
> --- a/drivers/lightnvm/core.c
> +++ b/drivers/lightnvm/core.c
> @@ -273,7 +273,7 @@ static int nvm_create_tgt(struct nvm_dev *dev, struct nvm_ioctl_create *create)
> goto err_disk;
> blk_queue_make_request(tqueue, tt->make_rq);
>
> - sprintf(tdisk->disk_name, "%s", create->tgtname);
> + strlcpy(tdisk->disk_name, create->tgtname, sizeof(tdisk->disk_name));
> tdisk->flags = GENHD_FL_EXT_DEVT;
> tdisk->major = 0;
> tdisk->first_minor = 0;
> @@ -1198,13 +1198,13 @@ static long nvm_ioctl_get_devices(struct file *file, void __user *arg)
> list_for_each_entry(dev, &nvm_devices, devices) {
> struct nvm_ioctl_device_info *info = &devices->info[i];
>
> - sprintf(info->devname, "%s", dev->name);
> + strlcpy(info->devname, dev->name, sizeof(info->devname));
>
> /* kept for compatibility */
> info->bmversion[0] = 1;
> info->bmversion[1] = 0;
> info->bmversion[2] = 0;
> - sprintf(info->bmname, "%s", "gennvm");
> + strlcpy(info->bmname, "gennvm", sizeof(info->bmname));
> i++;
>
> if (i > 31) {
>
Thanks. Applied for 4.12.