From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
patches@lists.linux.dev,
Kai-Heng Feng <kai.heng.feng@canonical.com>,
Damien Le Moal <damien.lemoal@opensource.wdc.com>
Subject: [PATCH 4.19 06/78] ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS
Date: Wed, 2 Nov 2022 03:33:51 +0100 [thread overview]
Message-ID: <20221102022053.102557650@linuxfoundation.org> (raw)
In-Reply-To: <20221102022052.895556444@linuxfoundation.org>
From: Kai-Heng Feng <kai.heng.feng@canonical.com>
commit 1e41e693f458eef2d5728207dbd327cd3b16580a upstream.
UBSAN complains about array-index-out-of-bounds:
[ 1.980703] kernel: UBSAN: array-index-out-of-bounds in /build/linux-9H675w/linux-5.15.0/drivers/ata/libahci.c:968:41
[ 1.980709] kernel: index 15 is out of range for type 'ahci_em_priv [8]'
[ 1.980713] kernel: CPU: 0 PID: 209 Comm: scsi_eh_8 Not tainted 5.15.0-25-generic #25-Ubuntu
[ 1.980716] kernel: Hardware name: System manufacturer System Product Name/P5Q3, BIOS 1102 06/11/2010
[ 1.980718] kernel: Call Trace:
[ 1.980721] kernel: <TASK>
[ 1.980723] kernel: show_stack+0x52/0x58
[ 1.980729] kernel: dump_stack_lvl+0x4a/0x5f
[ 1.980734] kernel: dump_stack+0x10/0x12
[ 1.980736] kernel: ubsan_epilogue+0x9/0x45
[ 1.980739] kernel: __ubsan_handle_out_of_bounds.cold+0x44/0x49
[ 1.980742] kernel: ahci_qc_issue+0x166/0x170 [libahci]
[ 1.980748] kernel: ata_qc_issue+0x135/0x240
[ 1.980752] kernel: ata_exec_internal_sg+0x2c4/0x580
[ 1.980754] kernel: ? vprintk_default+0x1d/0x20
[ 1.980759] kernel: ata_exec_internal+0x67/0xa0
[ 1.980762] kernel: sata_pmp_read+0x8d/0xc0
[ 1.980765] kernel: sata_pmp_read_gscr+0x3c/0x90
[ 1.980768] kernel: sata_pmp_attach+0x8b/0x310
[ 1.980771] kernel: ata_eh_revalidate_and_attach+0x28c/0x4b0
[ 1.980775] kernel: ata_eh_recover+0x6b6/0xb30
[ 1.980778] kernel: ? ahci_do_hardreset+0x180/0x180 [libahci]
[ 1.980783] kernel: ? ahci_stop_engine+0xb0/0xb0 [libahci]
[ 1.980787] kernel: ? ahci_do_softreset+0x290/0x290 [libahci]
[ 1.980792] kernel: ? trace_event_raw_event_ata_eh_link_autopsy_qc+0xe0/0xe0
[ 1.980795] kernel: sata_pmp_eh_recover.isra.0+0x214/0x560
[ 1.980799] kernel: sata_pmp_error_handler+0x23/0x40
[ 1.980802] kernel: ahci_error_handler+0x43/0x80 [libahci]
[ 1.980806] kernel: ata_scsi_port_error_handler+0x2b1/0x600
[ 1.980810] kernel: ata_scsi_error+0x9c/0xd0
[ 1.980813] kernel: scsi_error_handler+0xa1/0x180
[ 1.980817] kernel: ? scsi_unjam_host+0x1c0/0x1c0
[ 1.980820] kernel: kthread+0x12a/0x150
[ 1.980823] kernel: ? set_kthread_struct+0x50/0x50
[ 1.980826] kernel: ret_from_fork+0x22/0x30
[ 1.980831] kernel: </TASK>
This happens because sata_pmp_init_links() initialize link->pmp up to
SATA_PMP_MAX_PORTS while em_priv is declared as 8 elements array.
I can't find the maximum Enclosure Management ports specified in AHCI
spec v1.3.1, but "12.2.1 LED message type" states that "Port Multiplier
Information" can utilize 4 bits, which implies it can support up to 16
ports. Hence, use SATA_PMP_MAX_PORTS as EM_MAX_SLOTS to resolve the
issue.
BugLink: https://bugs.launchpad.net/bugs/1970074
Cc: stable@vger.kernel.org
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/ahci.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/ata/ahci.h
+++ b/drivers/ata/ahci.h
@@ -265,7 +265,7 @@ enum {
PCS_7 = 0x94, /* 7+ port PCS (Denverton) */
/* em constants */
- EM_MAX_SLOTS = 8,
+ EM_MAX_SLOTS = SATA_PMP_MAX_PORTS,
EM_MAX_RETRY = 5,
/* em_ctl bits */
next prev parent reply other threads:[~2022-11-02 3:28 UTC|newest]
Thread overview: 86+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-02 2:33 [PATCH 4.19 00/78] 4.19.264-rc1 review Greg Kroah-Hartman
2022-11-02 2:33 ` [PATCH 4.19 01/78] ocfs2: clear dinode links count in case of error Greg Kroah-Hartman
2022-11-02 2:33 ` [PATCH 4.19 02/78] ocfs2: fix BUG when iput after ocfs2_mknod fails Greg Kroah-Hartman
2022-11-02 2:33 ` [PATCH 4.19 03/78] x86/microcode/AMD: Apply the patch early on every logical thread Greg Kroah-Hartman
2022-11-02 2:33 ` [PATCH 4.19 04/78] hwmon/coretemp: Handle large core ID value Greg Kroah-Hartman
2022-11-02 2:33 ` [PATCH 4.19 05/78] ata: ahci-imx: Fix MODULE_ALIAS Greg Kroah-Hartman
2022-11-02 2:33 ` Greg Kroah-Hartman [this message]
2022-11-02 2:33 ` [PATCH 4.19 07/78] KVM: arm64: vgic: Fix exit condition in scan_its_table() Greg Kroah-Hartman
2022-11-02 2:33 ` [PATCH 4.19 08/78] media: venus: dec: Handle the case where find_format fails Greg Kroah-Hartman
2022-11-02 2:33 ` [PATCH 4.19 09/78] arm64: errata: Remove AES hwcap for COMPAT tasks Greg Kroah-Hartman
2022-11-02 2:33 ` [PATCH 4.19 10/78] r8152: add PID for the Lenovo OneLink+ Dock Greg Kroah-Hartman
2022-11-02 2:33 ` [PATCH 4.19 11/78] btrfs: fix processing of delayed data refs during backref walking Greg Kroah-Hartman
2022-11-02 2:33 ` [PATCH 4.19 12/78] btrfs: fix processing of delayed tree block " Greg Kroah-Hartman
2022-11-02 2:33 ` [PATCH 4.19 13/78] ACPI: extlog: Handle multiple records Greg Kroah-Hartman
2022-11-02 2:33 ` [PATCH 4.19 14/78] tipc: Fix recognition of trial period Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 15/78] tipc: fix an information leak in tipc_topsrv_kern_subscr Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 16/78] HID: magicmouse: Do not set BTN_MOUSE on double report Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 17/78] net/atm: fix proc_mpc_write incorrect return value Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 18/78] net: sched: cake: fix null pointer access issue when cake_init() fails Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 19/78] net: hns: fix possible memory leak in hnae_ae_register() Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 20/78] iommu/vt-d: Clean up si_domain in the init_dmars() error path Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 21/78] media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 22/78] [PATCH v3] ACPI: video: Force backlight native for more TongFang devices Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 23/78] Makefile.debug: re-enable debug info for .S files Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 24/78] hv_netvsc: Fix race between VF offering and VF association message from host Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 25/78] mm: /proc/pid/smaps_rollup: fix no vmas null-deref Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 26/78] can: kvaser_usb: Fix possible completions during init_completion Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 27/78] ALSA: Use del_timer_sync() before freeing timer Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 28/78] ALSA: au88x0: use explicitly signed char Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 29/78] USB: add RESET_RESUME quirk for NVIDIA Jetson devices in RCM Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 30/78] usb: dwc3: gadget: Stop processing more requests on IMI Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 31/78] usb: dwc3: gadget: Dont set IMI for no_interrupt Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 32/78] usb: bdc: change state when port disconnected Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 33/78] usb: xhci: add XHCI_SPURIOUS_SUCCESS to ASM1042 despite being a V0.96 controller Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 34/78] xhci: Remove device endpoints from bandwidth list when freeing the device Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 35/78] tools: iio: iio_utils: fix digit calculation Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 36/78] iio: light: tsl2583: Fix module unloading Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 37/78] fbdev: smscufx: Fix several use-after-free bugs Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 38/78] mac802154: Fix LQI recording Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 39/78] drm/msm/dsi: fix memory corruption with too many bridges Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 40/78] drm/msm/hdmi: " Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 41/78] mmc: core: Fix kernel panic when remove non-standard SDIO card Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 42/78] kernfs: fix use-after-free in __kernfs_remove Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 43/78] perf auxtrace: Fix address filter symbol name match for modules Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 44/78] s390/futex: add missing EX_TABLE entry to __futex_atomic_op() Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 45/78] Xen/gntdev: dont ignore kernel unmapping error Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 46/78] xen/gntdev: Prevent leaking grants Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 47/78] mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 48/78] net: ieee802154: fix error return code in dgram_bind() Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 49/78] drm/msm: Fix return type of mdp4_lvds_connector_mode_valid Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 50/78] arc: iounmap() arg is volatile Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 51/78] ALSA: ac97: fix possible memory leak in snd_ac97_dev_register() Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 52/78] tipc: fix a null-ptr-deref in tipc_topsrv_accept Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 53/78] net: netsec: fix error handling in netsec_register_mdio() Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 54/78] x86/unwind/orc: Fix unreliable stack dump with gcov Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 55/78] amd-xgbe: fix the SFP compliance codes check for DAC cables Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 56/78] amd-xgbe: add the bit rate quirk for Molex cables Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 57/78] kcm: annotate data-races around kcm->rx_psock Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 58/78] kcm: annotate data-races around kcm->rx_wait Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 59/78] net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 60/78] net: lantiq_etop: dont free skb when returning NETDEV_TX_BUSY Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 61/78] tcp: fix indefinite deferral of RTO with SACK reneging Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 62/78] can: mscan: mpc5xxx: mpc5xxx_can_probe(): add missing put_clock() in error path Greg Kroah-Hartman
2022-11-04 17:28 ` Pavel Machek
2022-11-02 2:34 ` [PATCH 4.19 63/78] PM: hibernate: Allow hybrid sleep to work with s2idle Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 64/78] media: vivid: s_fbuf: add more sanity checks Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 65/78] media: vivid: dev->bitmap_cap wasnt freed in all cases Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 66/78] media: v4l2-dv-timings: add sanity checks for blanking values Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 67/78] media: videodev2.h: V4L2_DV_BT_BLANKING_HEIGHT should check interlaced Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 68/78] i40e: Fix ethtool rx-flow-hash setting for X722 Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 69/78] i40e: Fix VF hang when reset is triggered on another VF Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 70/78] i40e: Fix flow-type by setting GL_HASH_INSET registers Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 71/78] net: ksz884x: fix missing pci_disable_device() on error in pcidev_init() Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 72/78] PM: domains: Fix handling of unavailable/disabled idle states Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 73/78] ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev() Greg Kroah-Hartman
2022-11-02 2:34 ` [PATCH 4.19 74/78] ALSA: aoa: Fix I2S device accounting Greg Kroah-Hartman
2022-11-02 2:35 ` [PATCH 4.19 75/78] openvswitch: switch from WARN to pr_warn Greg Kroah-Hartman
2022-11-02 2:35 ` [PATCH 4.19 76/78] net: ehea: fix possible memory leak in ehea_register_port() Greg Kroah-Hartman
2022-11-02 2:35 ` [PATCH 4.19 77/78] net/mlx5e: Do not increment ESN when updating IPsec ESN state Greg Kroah-Hartman
2022-11-02 2:35 ` [PATCH 4.19 78/78] can: rcar_canfd: rcar_canfd_handle_global_receive(): fix IRQ storm on global FIFO receive Greg Kroah-Hartman
2022-11-02 10:07 ` [PATCH 4.19 00/78] 4.19.264-rc1 review Jon Hunter
2022-11-02 17:22 ` Pavel Machek
2022-11-02 20:46 ` Guenter Roeck
2022-11-03 10:18 ` Naresh Kamboju
2022-11-03 12:22 ` Sudip Mukherjee
2022-11-04 15:17 ` zhouzhixiu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221102022053.102557650@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=damien.lemoal@opensource.wdc.com \
--cc=kai.heng.feng@canonical.com \
--cc=patches@lists.linux.dev \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox