[PATCH v2 00/17] scsi: mpi3mr: Fix out-of-bounds accesses and reference leaks

[Chandrakanth Patil <chandrakanth.patil@broadcom.com>]

This series contains a set of fixes for the mpi3mr driver:

 - out-of-bounds accesses where values reported by the controller
   (device handles, phy numbers, topology event entry counts, reply and
   sense buffer addresses, event data lengths) are used to index arrays,
   derive pointers or size copies without being checked first

 - out-of-bounds accesses in the BSG passthrough paths, from a request
   size held in too narrow a variable and from a copy made without
   checking the payload holds that much data

 - target device reference leaks and an I/O block counter leak on error
   and teardown paths, the latter leaving a device blocked for I/O

 - a response buffer copied back to user space without being zeroed
   first, so its unwritten fields carry whatever the allocation held

 - a use-after-free and a NULL dereference around the firmware event
   workqueue during driver removal and PCI error recovery

Changes in v2:
 - Patch 6: Switched to do_div() for alignment check to fix 32-bit
   build issue.
 - Patch 7: Switched to do_div() for alignment check to fix 32-bit
   build issue.
 - Patch 8: Relocated handle bounds check to the entry of
   mpi3mr_dev_rmhs_send_tm() so out-of-bounds handles are rejected
   immediately without polluting delayed_rmhs_list.
 - Patch 10: Cached num_entries in a local variable before bounds
   checking to eliminate the TOCTOU re-fetch race from DMA memory.
 - Patch 14: Cached num_entries in a local variable before bounds
   checking to eliminate the TOCTOU re-fetch race from DMA memory.
 - Patch 17: Removed stop_drv_processing and workqueue cleanup from
   pci_channel_io_frozen to prevent I/O breakage (DID_NO_CONNECT) and
   workqueue deadlocks. Added pci_err_recovery check in
   mpi3mr_fwevt_bh() to safely skip event processing.
 - Patches 1-5, 9, 11-13, 15-16: Unchanged from v1.

Chandrakanth Patil (17):
  mpi3mr: Fix buffer overflow in BSG passthrough request copy
  mpi3mr: Fix out-of-bounds read when copying BSG MPI requests
  mpi3mr: Fix I/O block counter leak on admin request post failure
  mpi3mr: Fix target device reference leak in BSG task management
  mpi3mr: Fix buffer overflow when caching log data
  mpi3mr: Fix out-of-bounds reply frame access
  mpi3mr: Fix out-of-bounds sense buffer access
  mpi3mr: Fix out-of-bounds bitmap access during device removal
  mpi3mr: Fix target device reference leak in device removal handshake
  mpi3mr: Fix out-of-bounds read in SAS topology change events
  mpi3mr: Fix out-of-bounds read of event data
  mpi3mr: Fix out-of-bounds phy array access on link change
  mpi3mr: Fix buffer overflow in the BSG target device map
  mpi3mr: Fix out-of-bounds read in PCIe topology change events
  mpi3mr: zero out diagnostic buffer status memory
  mpi3mr: Fix use-after-free of the firmware event workqueue
  mpi3mr: Fix NULL pointer dereference on PCI error recovery

 drivers/scsi/mpi3mr/mpi3mr_app.c       | 43 ++++++++----
 drivers/scsi/mpi3mr/mpi3mr_fw.c        | 17 ++++-
 drivers/scsi/mpi3mr/mpi3mr_os.c        | 95 +++++++++++++++++++++-----
 drivers/scsi/mpi3mr/mpi3mr_transport.c |  7 ++
 4 files changed, 133 insertions(+), 29 deletions(-)

-- 
2.52.0