15586 ddi_parse needs len

Reviewed by: Andy Fiddaman <illumos@fiddaman.net>
Reviewed by: Patrick Mooney <pmooney@pfmooney.com>
Approved by: Joshua M. Clulow <josh@sysmgr.org>

Author: danmcd

usr/src/uts/common/io/dls/dls_mgmt.c

@@ -1299,7 +1299,7 @@ dls_devnet_hold_by_name(const char *link, dls_devnet_t **ddpp)
 	 * If we reach this point it means dlmgmtd is up but has no
 	 * mapping for the link name.
 	 */
-	if (ddi_parse(link, drv, &ppa) != DDI_SUCCESS)
+	if (ddi_parse_dlen(link, drv, MAXLINKNAMELEN, &ppa) != DDI_SUCCESS)
 		return (ENOENT);
 
 	if (IS_IPTUN_LINK(drv)) {

usr/src/uts/common/io/ib/clients/rds/rds_ioctl.c

@@ -86,7 +86,7 @@ rds_capable_interface(struct lifreq *lifrp)
 	char	ifname[LIFNAMSIZ];
 	char	drv[MAXLINKNAMELEN];
 	uint_t	ppa;
-	char 	*cp;
+	char	*cp;
 
 	if (lifrp->lifr_type == IFT_IB)
 		return (B_TRUE);
@@ -106,7 +106,8 @@ rds_capable_interface(struct lifreq *lifrp)
 		return (B_TRUE);
 	}
 
-	return (ddi_parse(ifname, drv, &ppa) == DDI_SUCCESS &&
+	return (
+	    ddi_parse_dlen(ifname, drv, MAXLINKNAMELEN, &ppa) == DDI_SUCCESS &&
 	    rds_transport_ops->rds_transport_if_lookup_by_name(drv));
 }
 
@@ -187,7 +188,7 @@ rds_ioctl_copyin_done(queue_t *q, mblk_t *mp)
 		caddr_t ubuf_addr;
 		int	ubuf_size;
 		uint_t	bufsize;
-		int 	i, nifs;
+		int	i, nifs;
 		struct lifconf lifc;
 		struct lifreq *lifrp;
 		struct ifreq *ifrp;

usr/src/uts/common/io/ib/clients/rdsv3/rdsv3_impl.c

@@ -104,7 +104,8 @@ rdsv3_capable_interface(struct lifreq *lifrp)
 		return (B_TRUE);
 	}
 
-	return (ddi_parse(ifname, drv, &ppa) == DDI_SUCCESS &&
+	return (
+	    ddi_parse_dlen(ifname, drv, MAXLINKNAMELEN, &ppa) == DDI_SUCCESS &&
 	    rdsv3_if_lookup_by_name(drv));
 }
 
@@ -309,7 +310,8 @@ rdsv3_capable_interface_old(struct ifreq *ifrp)
 		return (B_TRUE);
 	}
 
-	return (ddi_parse(ifname, drv, &ppa) == DDI_SUCCESS &&
+	return (
+	    ddi_parse_dlen(ifname, drv, MAXLINKNAMELEN, &ppa) == DDI_SUCCESS &&
 	    rdsv3_if_lookup_by_name(drv));
 }
 

usr/src/uts/common/io/softmac/softmac_stat.c

@@ -42,9 +42,9 @@ typedef struct i_softmac_stat_info_s {
  * Must be the same order as mac_driver_stat.
  */
 static i_softmac_stat_info_t	i_softmac_driver_si[] = {
-	{ MAC_STAT_IFSPEED,	"ifspeed", 	"link_speed"	},
+	{ MAC_STAT_IFSPEED,	"ifspeed",	"link_speed"	},
 	{ MAC_STAT_MULTIRCV,	"multircv",	NULL		},
-	{ MAC_STAT_BRDCSTRCV,	"brdcstrcv", 	NULL		},
+	{ MAC_STAT_BRDCSTRCV,	"brdcstrcv",	NULL		},
 	{ MAC_STAT_MULTIXMT,	"multixmt",	NULL		},
 	{ MAC_STAT_BRDCSTXMT,	"brdcstxmt",	NULL		},
 	{ MAC_STAT_NORCVBUF,	"norcvbuf",	"rx_no_buf"	},
@@ -70,7 +70,7 @@ static i_softmac_stat_info_t	i_softmac_driver_si[] = {
 static i_softmac_stat_info_t	i_softmac_ether_si[] = {
 	{ ETHER_STAT_ALIGN_ERRORS,	"align_errors",
 	    "alignment_err" },
-	{ ETHER_STAT_FCS_ERRORS, 	"fcs_errors",		"crc_err" },
+	{ ETHER_STAT_FCS_ERRORS,	"fcs_errors",		"crc_err" },
 	{ ETHER_STAT_FIRST_COLLISIONS,	"first_collisions",	NULL },
 	{ ETHER_STAT_MULTI_COLLISIONS,	"multi_collisions",	NULL },
 	{ ETHER_STAT_SQE_ERRORS,	"sqe_errors",		NULL },
@@ -81,8 +81,8 @@ static i_softmac_stat_info_t	i_softmac_ether_si[] = {
 	    "excessive_collisions" },
 	{ ETHER_STAT_MACXMT_ERRORS,	"macxmt_errors",	NULL },
 	{ ETHER_STAT_CARRIER_ERRORS,	"carrier_errors",	NULL },
-	{ ETHER_STAT_TOOLONG_ERRORS,	"toolong_errors", 	"length_err" },
-	{ ETHER_STAT_MACRCV_ERRORS, 	"macrcv_errors",
+	{ ETHER_STAT_TOOLONG_ERRORS,	"toolong_errors",	"length_err" },
+	{ ETHER_STAT_MACRCV_ERRORS,	"macrcv_errors",
 	    "Rx Error Count" },
 
 	{ ETHER_STAT_XCVR_ADDR,		"xcvr_addr",		NULL },
@@ -106,8 +106,8 @@ static i_softmac_stat_info_t	i_softmac_ether_si[] = {
 	{ ETHER_STAT_ADV_CAP_10FDX,	"adv_cap_10fdx",	NULL },
 	{ ETHER_STAT_ADV_CAP_10HDX,	"adv_cap_10hdx",	NULL },
 	{ ETHER_STAT_ADV_CAP_ASMPAUSE,	"adv_cap_asmpause",	NULL },
-	{ ETHER_STAT_ADV_CAP_PAUSE,	"adv_cap_pause", 	NULL },
-	{ ETHER_STAT_ADV_CAP_AUTONEG,	"adv_cap_autoneg", 	NULL },
+	{ ETHER_STAT_ADV_CAP_PAUSE,	"adv_cap_pause",	NULL },
+	{ ETHER_STAT_ADV_CAP_AUTONEG,	"adv_cap_autoneg",	NULL },
 
 	{ ETHER_STAT_LP_CAP_1000FDX,	"lp_cap_1000fdx",	NULL },
 	{ ETHER_STAT_LP_CAP_1000HDX,	"lp_cap_1000hdx",	NULL },
@@ -121,7 +121,7 @@ static i_softmac_stat_info_t	i_softmac_ether_si[] = {
 
 	{ ETHER_STAT_LINK_ASMPAUSE,	"link_asmpause",	NULL },
 	{ ETHER_STAT_LINK_PAUSE,	"link_pause",		NULL },
-	{ ETHER_STAT_LINK_AUTONEG,	"link_autoneg", 	NULL },
+	{ ETHER_STAT_LINK_AUTONEG,	"link_autoneg",		NULL },
 	{ ETHER_STAT_LINK_DUPLEX,	"link_duplex",		"duplex" },
 
 	{ ETHER_STAT_TOOSHORT_ERRORS,	"runt_errors",		NULL },
@@ -177,8 +177,10 @@ softmac_hold_dev_kstat(softmac_t *softmac)
 	uint_t		ppa;
 	kstat_t		*ksp;
 
-	if (ddi_parse(softmac->smac_devname, drv, &ppa) != DDI_SUCCESS)
+	if (ddi_parse_dlen(softmac->smac_devname, drv, MAXLINKNAMELEN, &ppa) !=
+	    DDI_SUCCESS) {
 		return (NULL);
+	}
 
 	/*
 	 * Find the kstat by the module name and the instance number.

usr/src/uts/common/os/sunddi.c

@@ -23,6 +23,7 @@
  * Copyright (c) 1990, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright 2022 Garrett D'Amore
  * Copyright 2022 Tintri by DDN, Inc. All rights reserved.
+ * Copyright 2023 MNX Cloud, Inc.
  */
 
 #include <sys/note.h>
@@ -8957,29 +8958,54 @@ ddi_taskq_resume(ddi_taskq_t *tq)
 }
 
 int
-ddi_parse(
-	const char	*ifname,
-	char		*alnum,
-	uint_t		*nump)
+ddi_parse(const char *ifname, char *alnum, uint_t *nump)
+{
+	/*
+	 * Cap "alnum" size at LIFNAMSIZ, as callers use that in most/all
+	 * cases.
+	 */
+	return (ddi_parse_dlen(ifname, alnum, LIFNAMSIZ, nump));
+}
+
+int
+ddi_parse_dlen(const char *ifname, char *alnum, size_t alnumsize, uint_t *nump)
 {
 	const char	*p;
-	int		l;
+	int		copy_len;
 	ulong_t		num;
 	boolean_t	nonum = B_TRUE;
 	char		c;
 
-	l = strlen(ifname);
-	for (p = ifname + l; p != ifname; l--) {
+	copy_len = strlen(ifname);
+	for (p = ifname + copy_len; p != ifname; copy_len--) {
 		c = *--p;
 		if (!isdigit(c)) {
-			(void) strlcpy(alnum, ifname, l + 1);
+			/*
+			 * At this point, copy_len is the length of ifname
+			 * WITHOUT the PPA number. For "e1000g10" copy_len is 6.
+			 *
+			 * We must first make sure we HAVE a PPA, and we
+			 * aren't exceeding alnumsize with copy_len and a '\0'
+			 * terminator...
+			 */
+			int copy_len_nul = copy_len + 1;
+
+			if (nonum || alnumsize < copy_len_nul)
+				return (DDI_FAILURE);
+
+			/*
+			 * ... then we abuse strlcpy() to copy over the
+			 * driver name portion AND '\0'-terminate it.
+			 */
+			(void) strlcpy(alnum, ifname, copy_len_nul);
 			if (ddi_strtoul(p + 1, NULL, 10, &num) != 0)
 				return (DDI_FAILURE);
 			break;
 		}
 		nonum = B_FALSE;
 	}
-	if (l == 0 || nonum)
+
+	if (copy_len == 0)
 		return (DDI_FAILURE);
 
 	*nump = num;

usr/src/uts/common/sys/sunddi.h

@@ -2233,6 +2233,8 @@ boolean_t ddi_taskq_suspended(ddi_taskq_t *tq);
  * <numeric> is maximal.
  */
 int ddi_parse(const char *, char *, uint_t *);
+/* Version with caller-specified destination buffer length. */
+int ddi_parse_dlen(const char *, char *, size_t, uint_t *);
 
 /*
  * DDI interrupt priority level

usr/src/uts/sun4v/io/vsw.c

@@ -2166,8 +2166,7 @@ vsw_update_md_prop(vsw_t *vswp, md_t *mdp, mde_cookie_t node)
 		 * the vsw is being changed to 'routed' mode.
 		 */
 		if ((strlen(physname) != 0) &&
-		    (ddi_parse(physname, drv,
-		    &ddi_instance) != DDI_SUCCESS)) {
+		    (ddi_parse(physname, drv, &ddi_instance) != DDI_SUCCESS)) {
 			cmn_err(CE_WARN, "!vsw%d: physical device %s is not"
 			    " a valid device name/instance",
 			    vswp->instance, physname);