Ed Maste 0b29e1b9f9 mpr/mps/mpt: verify cfg page ioctl lengths ... *_CFG_PAGE ioctl handlers in the mpr, mps, and mpt drivers allocated a buffer of a caller-specified size, but copied to it a fixed size header. Add checks that the size is at least the required minimum. Note that the device nodes are owned by root:operator with 0640 permissions so the ioctls are not available to unprivileged users. This change includes suggestions from scottl, markj and mav. Two of the mpt cases were reported by Lucas Leong (@_wmliang_) of Trend Micro Zero Day Initiative; scottl reported the third case in mpt. Same issue found in mpr and mps after discussion with imp. Reported by: Lucas Leong (@_wmliang_), Trend Micro Zero Day Initiative Reviewed by: imp, mav MFC after: 3 days Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D34692 (cherry picked from commit 8276c4149b)		2022-04-03 20:45:41 -04:00
..
mpi
mps.c	mps/mpr: Relax doorbell polling precision.	2022-01-23 14:57:35 -05:00
mps_config.c	mps/mpr: Add missing newlines in error messages.	2022-03-01 21:39:10 -05:00
mps_ioctl.h
mps_mapping.c	mpr/mps(4): Make device mapping some more robust.	2021-05-24 10:43:39 -04:00
mps_mapping.h
mps_pci.c
mps_sas.c	mps(4): Fix unmatched devq release.	2022-01-06 14:03:38 -05:00
mps_sas.h
mps_sas_lsi.c	Fix "set but not used" warnings in the mps driver.	2022-01-06 14:01:59 -05:00
mps_table.c	Fix "set but not used" warnings in the mps driver.	2022-01-06 14:01:59 -05:00
mps_table.h
mps_user.c	mpr/mps/mpt: verify cfg page ioctl lengths	2022-04-03 20:45:41 -04:00
mpsvar.h	Fix mpr(4) and mps(4) state transitions and a use-after-free panic.	2021-09-02 20:33:28 -04:00