scsi: vmw_pvscsi: add boundary check for cmd_map access.

scsi: vmw_pvscsi: add boundary check for cmd_map access.

[Matt Wang]

The context value provided by the device in a completion is used to
index into cmd_map to find the command that was completed. To prevent
out of bounds access or completion of an inactive context, check that
the context value is in-bounds and that it maps to an active context.

Signed-off-by: Matt Wang <matt.wang@broadcom.com>
---
 drivers/scsi/vmw_pvscsi.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c
index 151cac9f9..49d1950a7 100644
--- a/drivers/scsi/vmw_pvscsi.c
+++ b/drivers/scsi/vmw_pvscsi.c
@@ -201,6 +201,9 @@ static u64 pvscsi_map_context(const struct pvscsi_adapter *adapter,
 static struct pvscsi_ctx *
 pvscsi_get_context(const struct pvscsi_adapter *adapter, u64 context)
 {
+	if (unlikely(context == 0 || context > adapter->req_depth)) {
+		return NULL;
+	}
 	return &adapter->cmd_map[context - 1];
 }
 
@@ -550,6 +553,11 @@ static void pvscsi_complete_request(struct pvscsi_adapter *adapter,
 	u32 sdstat = e->scsiStatus;
 
 	ctx = pvscsi_get_context(adapter, e->context);
+	if (ctx == NULL || ctx->cmd == NULL) {
+		dev_err_ratelimited(&adapter->dev->dev,
+				    "Can not find mapping for context %llu", e->context);
+		return;
+	}
 	cmd = ctx->cmd;
 	abort_cmp = ctx->abort_cmp;
 	pvscsi_unmap_buffers(adapter, ctx);
-- 
2.52.0

Re: scsi: vmw_pvscsi: add boundary check for cmd_map access.

[Martin K. Petersen]

Matt,

> The context value provided by the device in a completion is used to
> index into cmd_map to find the command that was completed. To prevent
> out of bounds access or completion of an inactive context, check that
> the context value is in-bounds and that it maps to an active context.

Applied to 7.5/scsi-staging, thanks!

-- 
Martin K. Petersen