* [PATCH] qla2xxx: Avoid triggering undefined behavior in qla2x00_mbx_completion()
@ 2018-01-25 16:24 Bart Van Assche
2018-01-25 16:55 ` Laurence Oberman
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Bart Van Assche @ 2018-01-25 16:24 UTC (permalink / raw)
To: Martin K . Petersen, James E . J . Bottomley
Cc: linux-scsi, Bart Van Assche, Himanshu Madhani
A left shift must shift less than the bit width of the left argument.
Avoid triggering undefined behavior if ha->mbx_count == 32.
This patch avoids that UBSAN reports the following complaint:
UBSAN: Undefined behaviour in drivers/scsi/qla2xxx/qla_isr.c:275:14
shift exponent 32 is too large for 32-bit type 'int'
Call Trace:
dump_stack+0x4e/0x6c
ubsan_epilogue+0xd/0x3b
__ubsan_handle_shift_out_of_bounds+0x112/0x14c
qla2x00_mbx_completion+0x1c5/0x25d [qla2xxx]
qla2300_intr_handler+0x1ea/0x3bb [qla2xxx]
qla2x00_mailbox_command+0x77b/0x139a [qla2xxx]
qla2x00_mbx_reg_test+0x83/0x114 [qla2xxx]
qla2x00_chip_diag+0x354/0x45f [qla2xxx]
qla2x00_initialize_adapter+0x2c2/0xa4e [qla2xxx]
qla2x00_probe_one+0x1681/0x392e [qla2xxx]
pci_device_probe+0x10b/0x1f1
driver_probe_device+0x21f/0x3a4
__driver_attach+0xa9/0xe1
bus_for_each_dev+0x6e/0xb5
driver_attach+0x22/0x3c
bus_add_driver+0x1d1/0x2ae
driver_register+0x78/0x130
__pci_register_driver+0x75/0xa8
qla2x00_module_init+0x21b/0x267 [qla2xxx]
do_one_initcall+0x5a/0x1e2
do_init_module+0x9d/0x285
load_module+0x20db/0x38e3
SYSC_finit_module+0xa8/0xbc
SyS_finit_module+0x9/0xb
do_syscall_64+0x77/0x271
entry_SYSCALL64_slow_path+0x25/0x25
Reported-by: Meelis Roos <mroos@linux.ee>
Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
Cc: Himanshu Madhani <himanshu.madhani@cavium.com>
---
drivers/scsi/qla2xxx/qla_isr.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index 16c43bd9bb83..79f538448364 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -272,7 +272,8 @@ qla2x00_mbx_completion(scsi_qla_host_t *vha, uint16_t mb0)
struct device_reg_2xxx __iomem *reg = &ha->iobase->isp;
/* Read all mbox registers? */
- mboxes = (1 << ha->mbx_count) - 1;
+ WARN_ON_ONCE(ha->mbx_count > 32);
+ mboxes = (1ULL << ha->mbx_count) - 1;
if (!ha->mcp)
ql_dbg(ql_dbg_async, vha, 0x5001, "MBX pointer ERROR.\n");
else
@@ -2884,7 +2885,8 @@ qla24xx_mbx_completion(scsi_qla_host_t *vha, uint16_t mb0)
struct device_reg_24xx __iomem *reg = &ha->iobase->isp24;
/* Read all mbox registers? */
- mboxes = (1 << ha->mbx_count) - 1;
+ WARN_ON_ONCE(ha->mbx_count > 32);
+ mboxes = (1ULL << ha->mbx_count) - 1;
if (!ha->mcp)
ql_dbg(ql_dbg_async, vha, 0x504e, "MBX pointer ERROR.\n");
else
--
2.16.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] qla2xxx: Avoid triggering undefined behavior in qla2x00_mbx_completion()
2018-01-25 16:24 [PATCH] qla2xxx: Avoid triggering undefined behavior in qla2x00_mbx_completion() Bart Van Assche
@ 2018-01-25 16:55 ` Laurence Oberman
2018-01-26 17:17 ` Madhani, Himanshu
2018-01-31 2:33 ` Martin K. Petersen
2 siblings, 0 replies; 4+ messages in thread
From: Laurence Oberman @ 2018-01-25 16:55 UTC (permalink / raw)
To: Bart Van Assche, Martin K . Petersen, James E . J . Bottomley
Cc: linux-scsi, Himanshu Madhani
On Thu, 2018-01-25 at 08:24 -0800, Bart Van Assche wrote:
> A left shift must shift less than the bit width of the left argument.
> Avoid triggering undefined behavior if ha->mbx_count == 32.
>
> This patch avoids that UBSAN reports the following complaint:
>
> UBSAN: Undefined behaviour in drivers/scsi/qla2xxx/qla_isr.c:275:14
> shift exponent 32 is too large for 32-bit type 'int'
> Call Trace:
> dump_stack+0x4e/0x6c
> ubsan_epilogue+0xd/0x3b
> __ubsan_handle_shift_out_of_bounds+0x112/0x14c
> qla2x00_mbx_completion+0x1c5/0x25d [qla2xxx]
> qla2300_intr_handler+0x1ea/0x3bb [qla2xxx]
> qla2x00_mailbox_command+0x77b/0x139a [qla2xxx]
> qla2x00_mbx_reg_test+0x83/0x114 [qla2xxx]
> qla2x00_chip_diag+0x354/0x45f [qla2xxx]
> qla2x00_initialize_adapter+0x2c2/0xa4e [qla2xxx]
> qla2x00_probe_one+0x1681/0x392e [qla2xxx]
> pci_device_probe+0x10b/0x1f1
> driver_probe_device+0x21f/0x3a4
> __driver_attach+0xa9/0xe1
> bus_for_each_dev+0x6e/0xb5
> driver_attach+0x22/0x3c
> bus_add_driver+0x1d1/0x2ae
> driver_register+0x78/0x130
> __pci_register_driver+0x75/0xa8
> qla2x00_module_init+0x21b/0x267 [qla2xxx]
> do_one_initcall+0x5a/0x1e2
> do_init_module+0x9d/0x285
> load_module+0x20db/0x38e3
> SYSC_finit_module+0xa8/0xbc
> SyS_finit_module+0x9/0xb
> do_syscall_64+0x77/0x271
> entry_SYSCALL64_slow_path+0x25/0x25
>
> Reported-by: Meelis Roos <mroos@linux.ee>
> Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
> Cc: Himanshu Madhani <himanshu.madhani@cavium.com>
> ---
> drivers/scsi/qla2xxx/qla_isr.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/scsi/qla2xxx/qla_isr.c
> b/drivers/scsi/qla2xxx/qla_isr.c
> index 16c43bd9bb83..79f538448364 100644
> --- a/drivers/scsi/qla2xxx/qla_isr.c
> +++ b/drivers/scsi/qla2xxx/qla_isr.c
> @@ -272,7 +272,8 @@ qla2x00_mbx_completion(scsi_qla_host_t *vha,
> uint16_t mb0)
> struct device_reg_2xxx __iomem *reg = &ha->iobase->isp;
>
> /* Read all mbox registers? */
> - mboxes = (1 << ha->mbx_count) - 1;
> + WARN_ON_ONCE(ha->mbx_count > 32);
> + mboxes = (1ULL << ha->mbx_count) - 1;
> if (!ha->mcp)
> ql_dbg(ql_dbg_async, vha, 0x5001, "MBX pointer
> ERROR.\n");
> else
> @@ -2884,7 +2885,8 @@ qla24xx_mbx_completion(scsi_qla_host_t *vha,
> uint16_t mb0)
> struct device_reg_24xx __iomem *reg = &ha->iobase->isp24;
>
> /* Read all mbox registers? */
> - mboxes = (1 << ha->mbx_count) - 1;
> + WARN_ON_ONCE(ha->mbx_count > 32);
> + mboxes = (1ULL << ha->mbx_count) - 1;
> if (!ha->mcp)
> ql_dbg(ql_dbg_async, vha, 0x504e, "MBX pointer
> ERROR.\n");
> else
This looks fine to me and I tested the earlier patch suggestion
supplied by Meelis.
Reviewed-by: Laurence Oberman <loberman@redhat.com>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] qla2xxx: Avoid triggering undefined behavior in qla2x00_mbx_completion()
2018-01-25 16:24 [PATCH] qla2xxx: Avoid triggering undefined behavior in qla2x00_mbx_completion() Bart Van Assche
2018-01-25 16:55 ` Laurence Oberman
@ 2018-01-26 17:17 ` Madhani, Himanshu
2018-01-31 2:33 ` Martin K. Petersen
2 siblings, 0 replies; 4+ messages in thread
From: Madhani, Himanshu @ 2018-01-26 17:17 UTC (permalink / raw)
To: Bart Van Assche
Cc: Martin K . Petersen, James E . J . Bottomley,
linux-scsi@vger.kernel.org
> On Jan 25, 2018, at 8:24 AM, Bart Van Assche <bart.vanassche@wdc.com> wrote:
>
> A left shift must shift less than the bit width of the left argument.
> Avoid triggering undefined behavior if ha->mbx_count == 32.
>
> This patch avoids that UBSAN reports the following complaint:
>
> UBSAN: Undefined behaviour in drivers/scsi/qla2xxx/qla_isr.c:275:14
> shift exponent 32 is too large for 32-bit type 'int'
> Call Trace:
> dump_stack+0x4e/0x6c
> ubsan_epilogue+0xd/0x3b
> __ubsan_handle_shift_out_of_bounds+0x112/0x14c
> qla2x00_mbx_completion+0x1c5/0x25d [qla2xxx]
> qla2300_intr_handler+0x1ea/0x3bb [qla2xxx]
> qla2x00_mailbox_command+0x77b/0x139a [qla2xxx]
> qla2x00_mbx_reg_test+0x83/0x114 [qla2xxx]
> qla2x00_chip_diag+0x354/0x45f [qla2xxx]
> qla2x00_initialize_adapter+0x2c2/0xa4e [qla2xxx]
> qla2x00_probe_one+0x1681/0x392e [qla2xxx]
> pci_device_probe+0x10b/0x1f1
> driver_probe_device+0x21f/0x3a4
> __driver_attach+0xa9/0xe1
> bus_for_each_dev+0x6e/0xb5
> driver_attach+0x22/0x3c
> bus_add_driver+0x1d1/0x2ae
> driver_register+0x78/0x130
> __pci_register_driver+0x75/0xa8
> qla2x00_module_init+0x21b/0x267 [qla2xxx]
> do_one_initcall+0x5a/0x1e2
> do_init_module+0x9d/0x285
> load_module+0x20db/0x38e3
> SYSC_finit_module+0xa8/0xbc
> SyS_finit_module+0x9/0xb
> do_syscall_64+0x77/0x271
> entry_SYSCALL64_slow_path+0x25/0x25
>
> Reported-by: Meelis Roos <mroos@linux.ee>
> Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
> Cc: Himanshu Madhani <himanshu.madhani@cavium.com>
> ---
> drivers/scsi/qla2xxx/qla_isr.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
> index 16c43bd9bb83..79f538448364 100644
> --- a/drivers/scsi/qla2xxx/qla_isr.c
> +++ b/drivers/scsi/qla2xxx/qla_isr.c
> @@ -272,7 +272,8 @@ qla2x00_mbx_completion(scsi_qla_host_t *vha, uint16_t mb0)
> struct device_reg_2xxx __iomem *reg = &ha->iobase->isp;
>
> /* Read all mbox registers? */
> - mboxes = (1 << ha->mbx_count) - 1;
> + WARN_ON_ONCE(ha->mbx_count > 32);
> + mboxes = (1ULL << ha->mbx_count) - 1;
> if (!ha->mcp)
> ql_dbg(ql_dbg_async, vha, 0x5001, "MBX pointer ERROR.\n");
> else
> @@ -2884,7 +2885,8 @@ qla24xx_mbx_completion(scsi_qla_host_t *vha, uint16_t mb0)
> struct device_reg_24xx __iomem *reg = &ha->iobase->isp24;
>
> /* Read all mbox registers? */
> - mboxes = (1 << ha->mbx_count) - 1;
> + WARN_ON_ONCE(ha->mbx_count > 32);
> + mboxes = (1ULL << ha->mbx_count) - 1;
> if (!ha->mcp)
> ql_dbg(ql_dbg_async, vha, 0x504e, "MBX pointer ERROR.\n");
> else
> --
> 2.16.0
>
Thanks for the formal patch.
Acked-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Thanks,
- Himanshu
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] qla2xxx: Avoid triggering undefined behavior in qla2x00_mbx_completion()
2018-01-25 16:24 [PATCH] qla2xxx: Avoid triggering undefined behavior in qla2x00_mbx_completion() Bart Van Assche
2018-01-25 16:55 ` Laurence Oberman
2018-01-26 17:17 ` Madhani, Himanshu
@ 2018-01-31 2:33 ` Martin K. Petersen
2 siblings, 0 replies; 4+ messages in thread
From: Martin K. Petersen @ 2018-01-31 2:33 UTC (permalink / raw)
To: Bart Van Assche
Cc: Martin K . Petersen, James E . J . Bottomley, linux-scsi,
Himanshu Madhani
Bart,
> A left shift must shift less than the bit width of the left argument.
> Avoid triggering undefined behavior if ha->mbx_count == 32.
Applied to 4.16/scsi-fixes. Thank you!
--
Martin K. Petersen Oracle Linux Engineering
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2018-01-31 2:44 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-01-25 16:24 [PATCH] qla2xxx: Avoid triggering undefined behavior in qla2x00_mbx_completion() Bart Van Assche
2018-01-25 16:55 ` Laurence Oberman
2018-01-26 17:17 ` Madhani, Himanshu
2018-01-31 2:33 ` Martin K. Petersen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox