Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1704453
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 4.4 32/91] mpt3sas: Dont overreach ioc->reply_post[] during initialization |
| Date | 2017-08-05 02:00 +0200 |
| Message-ID | <uaUFC-5lm-61@gated-at.bofh.it> (permalink) |
| References | <uaUcx-5a1-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Calvin Owens <calvinowens@fb.com>
commit 5ec8a1753bc29efa7e4b1391d691c9c719b30257 upstream.
In _base_make_ioc_operational(), we walk ioc->reply_queue_list and pull
a pointer out of successive elements of ioc->reply_post[] for each entry
in that list if RDPQ is enabled.
Since the code pulls the pointer for the next iteration at the bottom of
the loop, it triggers the a KASAN dump on the final iteration:
BUG: KASAN: slab-out-of-bounds in _base_make_ioc_operational+0x47b7/0x47e0 [mpt3sas] at addr ffff880754816ab0
Read of size 8 by task modprobe/305
<snip>
Call Trace:
[<ffffffff81dfc591>] dump_stack+0x4d/0x6c
[<ffffffff814c9689>] print_trailer+0xf9/0x150
[<ffffffff814ceda4>] object_err+0x34/0x40
[<ffffffff814d1231>] kasan_report_error+0x221/0x530
[<ffffffff814d1673>] __asan_report_load8_noabort+0x43/0x50
[<ffffffffa0043637>] _base_make_ioc_operational+0x47b7/0x47e0 [mpt3sas]
[<ffffffffa0049a51>] mpt3sas_base_attach+0x1991/0x2120 [mpt3sas]
[<ffffffffa0053c93>] _scsih_probe+0xeb3/0x16b0 [mpt3sas]
[<ffffffff81ebd047>] local_pci_probe+0xc7/0x170
[<ffffffff81ebf2cf>] pci_device_probe+0x20f/0x290
[<ffffffff820d50cd>] really_probe+0x17d/0x600
[<ffffffff820d56a3>] __driver_attach+0x153/0x190
[<ffffffff820cffac>] bus_for_each_dev+0x11c/0x1a0
[<ffffffff820d421d>] driver_attach+0x3d/0x50
[<ffffffff820d378a>] bus_add_driver+0x44a/0x5f0
[<ffffffff820d666c>] driver_register+0x18c/0x3b0
[<ffffffff81ebcb76>] __pci_register_driver+0x156/0x200
[<ffffffffa00c8135>] _mpt3sas_init+0x135/0x1000 [mpt3sas]
[<ffffffff81000423>] do_one_initcall+0x113/0x2b0
[<ffffffff813caa5a>] do_init_module+0x1d0/0x4d8
[<ffffffff81273909>] load_module+0x6729/0x8dc0
[<ffffffff81276123>] SYSC_init_module+0x183/0x1a0
[<ffffffff8127625e>] SyS_init_module+0xe/0x10
[<ffffffff828fe7d7>] entry_SYSCALL_64_fastpath+0x12/0x6a
Fix this by pulling the value at the beginning of the loop.
Signed-off-by: Calvin Owens <calvinowens@fb.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Reviewed-by: Jens Axboe <axboe@fb.com>
Acked-by: Chaitra Basappa <chaitra.basappa@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/mpt3sas/mpt3sas_base.c | 33 ++++++++++++++++-----------------
1 file changed, 16 insertions(+), 17 deletions(-)
--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
@@ -4981,15 +4981,14 @@ _base_make_ioc_ready(struct MPT3SAS_ADAP
static int
_base_make_ioc_operational(struct MPT3SAS_ADAPTER *ioc, int sleep_flag)
{
- int r, i;
+ int r, i, index;
unsigned long flags;
u32 reply_address;
u16 smid;
struct _tr_list *delayed_tr, *delayed_tr_next;
u8 hide_flag;
struct adapter_reply_queue *reply_q;
- long reply_post_free;
- u32 reply_post_free_sz, index = 0;
+ Mpi2ReplyDescriptorsUnion_t *reply_post_free_contig;
dinitprintk(ioc, pr_info(MPT3SAS_FMT "%s\n", ioc->name,
__func__));
@@ -5061,27 +5060,27 @@ _base_make_ioc_operational(struct MPT3SA
_base_assign_reply_queues(ioc);
/* initialize Reply Post Free Queue */
- reply_post_free_sz = ioc->reply_post_queue_depth *
- sizeof(Mpi2DefaultReplyDescriptor_t);
- reply_post_free = (long)ioc->reply_post[index].reply_post_free;
+ index = 0;
+ reply_post_free_contig = ioc->reply_post[0].reply_post_free;
list_for_each_entry(reply_q, &ioc->reply_queue_list, list) {
+ /*
+ * If RDPQ is enabled, switch to the next allocation.
+ * Otherwise advance within the contiguous region.
+ */
+ if (ioc->rdpq_array_enable) {
+ reply_q->reply_post_free =
+ ioc->reply_post[index++].reply_post_free;
+ } else {
+ reply_q->reply_post_free = reply_post_free_contig;
+ reply_post_free_contig += ioc->reply_post_queue_depth;
+ }
+
reply_q->reply_post_host_index = 0;
- reply_q->reply_post_free = (Mpi2ReplyDescriptorsUnion_t *)
- reply_post_free;
for (i = 0; i < ioc->reply_post_queue_depth; i++)
reply_q->reply_post_free[i].Words =
cpu_to_le64(ULLONG_MAX);
if (!_base_is_controller_msix_enabled(ioc))
goto skip_init_reply_post_free_queue;
- /*
- * If RDPQ is enabled, switch to the next allocation.
- * Otherwise advance within the contiguous region.
- */
- if (ioc->rdpq_array_enable)
- reply_post_free = (long)
- ioc->reply_post[++index].reply_post_free;
- else
- reply_post_free += reply_post_free_sz;
}
skip_init_reply_post_free_queue:
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 4.4 00/91] 4.4.80-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 23/91] nfc: fdp: fix NULL pointer dereference Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 38/91] libnvdimm, btt: fix btt_rw_page not returning errors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 06/91] md/raid5: add thread_group worker async_tx_issue_pending_all Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 04/91] powerpc/pseries: Fix of_node_put() underflow during reconfig remove Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 26/91] isdn/i4l: fix buffer overflow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 29/91] mailbox: always wait in mbox_send_message for blocking Tx mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 05/91] crypto: authencesn - Fix digest_null crash Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 28/91] wil6210: fix deadlock when using fw_no_recovery option Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 54/91] x86/mce/AMD: Make the init code more robust Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 62/91] irqchip/keystone: Fix "scheduling while atomic" on rt Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 53/91] tpm: Replace device number bitmap with IDR Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 47/91] pstore: Use dynamic spinlock initializer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 17/91] drm: rcar-du: Simplify and fix probe error handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
Re: [PATCH 4.4 17/91] drm: rcar-du: Simplify and fix probe error handling Ben Hutchings <ben.hutchings@codethink.co.uk> - 2017-08-07 17:20 +0200
Re: [PATCH 4.4 17/91] drm: rcar-du: Simplify and fix probe error handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-08 18:30 +0200
[PATCH 4.4 34/91] kaweth: fix oops upon failed memory allocation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 07/91] drm/vmwgfx: Fix gcc-7.1.1 warning Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 25/91] isdn: Fix a sleep-in-atomic bug Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 39/91] ipmi/watchdog: fix watchdog timeout set on reboot Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 36/91] PM / Domains: defer dev_pm_domain_set() until genpd->attach_dev succeeds if present Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 03/91] net: reduce skb_warn_bad_offload() noise Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 32/91] mpt3sas: Dont overreach ioc->reply_post[] during initialization Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 08/91] drm/nouveau/bar/gf100: fix access to upper half of BAR2 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 27/91] ath10k: fix null deref on wmi-tlv when trying spectral scan Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 09/91] KVM: PPC: Book3S HV: Context-switch EBB registers properly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 60/91] drm/msm: Verify that MSM_SUBMIT_BO_FLAGS are set Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 22/91] xfs: dont BUG() on mixed direct and mapped I/O Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 15/91] drm/rcar: Nuke preclose hook Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:10 +0200
[PATCH 4.4 18/91] perf intel-pt: Fix ip compression Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:10 +0200
[PATCH 4.4 13/91] Revert "powerpc/numa: Fix percpu allocations to be NUMA aware" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:10 +0200
[PATCH 4.4 11/91] KVM: PPC: Book3S HV: Reload HTM registers explicitly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:10 +0200
[PATCH 4.4 14/91] Staging: comedi: comedi_fops: Avoid orphaned proc entry Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:10 +0200
[PATCH 4.4 16/91] drm: rcar-du: Perform initialization/cleanup at probe/remove time Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:10 +0200
[PATCH 4.4 19/91] perf intel-pt: Fix last_ip usage Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:10 +0200
[PATCH 4.4 10/91] KVM: PPC: Book3S HV: Restore critical SPRs to host values on guest exit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:10 +0200
Re: [PATCH 4.4 00/91] 4.4.80-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-08-05 04:00 +0200
Re: [PATCH 4.4 00/91] 4.4.80-stable review Guenter Roeck <linux@roeck-us.net> - 2017-08-05 08:20 +0200
csiph-web