MFC r327497, r327498: fix memory disclosure in hpt* ioctls

r327497: hpt27xx: plug info leak in hpt_ioctl

The hpt27xx ioctl handler allocates a buffer without M_ZERO and calls
hpt_do_ioctl(), which might not overwrite the entire buffer.

Also zero bytesReturned in case it is not written by hpt_do_ioctl().

The hpt27xx device has permissions only for root so this is not urgent,
and the fix can be MFCd and considered for a future EN.

Reported by: Ilja van Sprundel <ivansprundel@ioactive.com>
Submitted by: Domagoj Stolfa <domagoj.stolfa@gmail.com> (M_ZERO)

r327498: hpt{nr,rr}: plug info leak in hpt_ioctl

The hpt{nr,rr} ioctl handler allocates a buffer without M_ZERO and calls
hpt_do_ioctl(), which might not overwrite the entire buffer.

Also zero bytesReturned in case it is not written by hpt_do_ioctl().

The hpt27{nr,rr} device has permissions only for root so this is not urgent,
and the fix can be MFCd and considered for a future EN.

The same issue was reported in the hpt27xx driver by Ilja Van Sprundel.

Security: memory disclosure in root-only ioctls
Sponsored by: The FreeBSD Foundation

MFC r325383:

Avoid calling get_controller_count() until attaching, this would avoid
costly PCI config space operations that slows down systems without the
hardware.

Many thanks to HighPoint for continued support of FreeBSD!

Submitted by: Steve Chang
Reported by: cperciva

MFC r311305 (by asomers):
Always null-terminate ccb_pathinq.(sim_vid|hba_vid|dev_name)

The sim_vid, hba_vid, and dev_name fields of struct ccb_pathinq are
fixed-length strings. AFAICT the only place they're read is in
sbin/camcontrol/camcontrol.c, which assumes they'll be null-terminated.
However, the kernel doesn't null-terminate them. A bunch of copy-pasted code
uses strncpy to write them, and doesn't guarantee null-termination. For at
least 4 drivers (mpr, mps, ciss, and hyperv), the hba_vid field actually
overflows. You can see the result by doing "camcontrol negotiate da0 -v".

This change null-terminates those fields everywhere they're set in the
kernel. It also shortens a few strings to ensure they'll fit within the
16-character field.

PR: 215474
Reported by: Coverity
CID: 1009997 1010000 1010001 1010002 1010003 1010004 1010005
CID: 1331519 1010006 1215097 1010007 1288967 1010008 1306000
CID: 1211924 1010009 1010010 1010011 1010012 1010013 1010014
CID: 1147190 1010017 1010016 1010018 1216435 1010020 1010021
CID: 1010022 1009666 1018185 1010023 1010025 1010026 1010027
CID: 1010028 1010029 1010030 1010031 1010033 1018186 1018187
CID: 1010035 1010036 1010042 1010041 1010040 1010039

MFC r313554:
Clean redundant MIN/MAX declarations in some HighPoint drivers.

The hpt27xx(4), hptnr(4), and hptrr(4) drivers declare MIN() and MAX()
internally which match the macros from sys/param.h.

MIN() is not used, MAX is only used once and can be replaced with the
max() version in libkern.h which operates on u_ints.

MFC after: 2 weeks

MFC r267386,269611,284730:

Update vendor driver to 1.2.7. This update improves driver reliability and
adds support of 4Kn drives and report LUNs command.

Many thanks to HighPoint for providing this driver update.

MFC r267290:
Make the hpt27xx(4) driver MPSAFE

Sponsored by: Multiplay

MFC r267368:

Apply vendor fixes to the High Point drivers:

- Don't call xpt_free_path() in os_query_remove_device() and
always return TRUE.
- Update os_buildsgl() to support build logical SG table which
will be used by lower RAID module.
- Return CAM_SEL_TIMEOUTstatus for SCSIcommand failed as target
missing.

Many thanks to HighPoint for providing this driver update.

Submitted by: Steve Chang
Reviewed by: mav

MFC r267386,269611,284730:

Update vendor driver to 1.2.7. This update improves driver reliability and
adds support of 4Kn drives and report LUNs command.

Many thanks to HighPoint for providing this driver update.

MFC r267290:
Make the hpt27xx(4) driver MPSAFE

Sponsored by: Multiplay

MFC r267368:

Apply vendor fixes to the High Point drivers:

- Don't call xpt_free_path() in os_query_remove_device() and
always return TRUE.
- Update os_buildsgl() to support build logical SG table which
will be used by lower RAID module.
- Return CAM_SEL_TIMEOUTstatus for SCSIcommand failed as target
missing.

Many thanks to HighPoint for providing this driver update.

Submitted by: Steve Chang
Reviewed by: mav