From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757551AbYHRSpm (ORCPT ); Mon, 18 Aug 2008 14:45:42 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1757448AbYHRSpc (ORCPT ); Mon, 18 Aug 2008 14:45:32 -0400 Received: from ns1.suse.de ([195.135.220.2]:40991 "EHLO mx1.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754688AbYHRSpb (ORCPT ); Mon, 18 Aug 2008 14:45:31 -0400 Date: Mon, 18 Aug 2008 11:41:26 -0700 From: Greg KH To: linux-kernel@vger.kernel.org, stable@kernel.org, jejb@kernel.org Cc: Justin Forbes , Zwane Mwaikambo , "Theodore Ts'o" , Randy Dunlap , Dave Jones , Chuck Wolber , Chris Wedgwood , Michael Krufky , Chuck Ebbert , Domenico Andreoli , Willy Tarreau , Rodrigo Rubira Branco , Jake Edge , Eugene Teo , torvalds@linux-foundation.org, akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk, James Bottomley Subject: [patch 02/60] SCSI: ses: fix VPD inquiry overrun Message-ID: <20080818184126.GC29394@suse.de> References: <20080818183230.966310219@mini.kroah.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline; filename="scsi-ses-fix-vpd-inquiry-overrun.patch" In-Reply-To: <20080818184035.GA29394@suse.de> User-Agent: Mutt/1.5.16 (2007-06-09) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 2.6.26-stable review patch. If anyone has any objections, please let us know. ------------------ From: James Bottomley commit 671a99c8eb2f1dde08ac5538d8cd912047c61ddf upstream There are a few kerneloops.org reports like this one: http://www.kerneloops.org/search.php?search=ses_match_to_enclosure That seem to imply we're running off the end of the VPD inquiry data (although at 512 bytes, it should be long enough for just about anything). we should be using correctly sized buffers anyway, so put those in and hope this oops goes away. Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman --- drivers/scsi/ses.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) --- a/drivers/scsi/ses.c +++ b/drivers/scsi/ses.c @@ -345,14 +345,14 @@ static int ses_enclosure_find_by_addr(st return 0; } -#define VPD_INQUIRY_SIZE 512 +#define VPD_INQUIRY_SIZE 36 static void ses_match_to_enclosure(struct enclosure_device *edev, struct scsi_device *sdev) { unsigned char *buf = kmalloc(VPD_INQUIRY_SIZE, GFP_KERNEL); unsigned char *desc; - int len; + u16 vpd_len; struct efd efd = { .addr = 0, }; @@ -372,9 +372,19 @@ static void ses_match_to_enclosure(struc VPD_INQUIRY_SIZE, NULL, SES_TIMEOUT, SES_RETRIES)) goto free; - len = (buf[2] << 8) + buf[3]; + vpd_len = (buf[2] << 8) + buf[3]; + kfree(buf); + buf = kmalloc(vpd_len, GFP_KERNEL); + if (!buf) + return; + cmd[3] = vpd_len >> 8; + cmd[4] = vpd_len & 0xff; + if (scsi_execute_req(sdev, cmd, DMA_FROM_DEVICE, buf, + vpd_len, NULL, SES_TIMEOUT, SES_RETRIES)) + goto free; + desc = buf + 4; - while (desc < buf + len) { + while (desc < buf + vpd_len) { enum scsi_protocol proto = desc[0] >> 4; u8 code_set = desc[0] & 0x0f; u8 piv = desc[1] & 0x80; --