From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AIpwx48yaldjO3mvk/ETLJDcRd1L2VqFPShS3FxThcqVTiLyg++aRVACmHmCM9gztW05dQMIgyyL ARC-Seal: i=1; a=rsa-sha256; t=1523399853; cv=none; d=google.com; s=arc-20160816; b=Vs76K2Ea5Fjp/z80Y92FT53ezIMU5NBKSpWTx8wrcSwL1XEGNxqXf31N0zOsFP8KMu 0955y3tQ0Wjk9nmREZ6GZapOxOTDRWQ/12NSZZyNb8nBTLa1DIJl7UdNDIb9zIOXwxED lZ0GLqwsUDaNrQLRAIwsh/I6IVYjCNVzA5oZHZMmQRvJVZltoi1DHWNI1a1tSc7YRgys Mn5VNkEa4EFGfsR67AyDERMPkAdni+VdDaotpQsg/toVtLQGU/akFwDtMsC6bZw8ioZ4 DgRMEQ0wdYK7k8FE0lvAIQhJCxQyUniovxwPmD/u6LFycPTvKxM+THMQWCX21qbrW13I Q69w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:user-agent:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=yeCf8WIG6WNZ3TQijIuZDoGFIYRBtfqz3CLoJGM8DAI=; b=xpldzl7ldVXxrpEd3QgR7tOqYDNleS4OFkqFq0Zs+Ux5bSL54dcwfg1EYlWbIMQS87 EDoFViAsKuHFms5dd8pQkKGoIw7+noGC11p6CFE+jw575KpIN8JYb+Tz3m3EDJFX2eno YGyAWTCaDeHVz+gQuKUr8vim6meN/vTKJCKCI5Meslf7opAqDC2z3xmWuPbityrLsy4B 7UfomiUs1whFza/opa+FB7F7qBpC2cl2W/mJKqq0qJMfc3G3yY6X7cz64G6r5YfDKBrU 3nSRvyeyWu7j4VSkkP4j6WoLPyurPwJ5fYDmeFSyg9bUale6QOXvQsNST2FV7tp0wzYp l1NQ== ARC-Authentication-Results: i=1; mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.61.202 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.61.202 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sumit Saxena , Shivasharan S , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 4.14 070/138] scsi: megaraid_sas: Error handling for invalid ldcount provided by firmware in RAID map Date: Wed, 11 Apr 2018 00:24:20 +0200 Message-Id: <20180410212910.248591048@linuxfoundation.org> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20180410212902.121524696@linuxfoundation.org> References: <20180410212902.121524696@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-LABELS: =?utf-8?b?IlxcU2VudCI=?= X-GMAIL-THRID: =?utf-8?q?1597400074797676914?= X-GMAIL-MSGID: =?utf-8?q?1597400524468030670?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: 4.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Shivasharan S [ Upstream commit 7ada701d0d5e5c6d357e157a72b841db3e8d03f4 ] Currently driver does not validate ldcount provided by firmware. If the value is invalid, fail RAID map validation accordingly. This issue is rare to hit in field and is fixed as part of code review. Signed-off-by: Sumit Saxena Signed-off-by: Shivasharan S Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman --- drivers/scsi/megaraid/megaraid_sas_fp.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) --- a/drivers/scsi/megaraid/megaraid_sas_fp.c +++ b/drivers/scsi/megaraid/megaraid_sas_fp.c @@ -168,7 +168,7 @@ static struct MR_LD_SPAN *MR_LdSpanPtrGe /* * This function will Populate Driver Map using firmware raid map */ -void MR_PopulateDrvRaidMap(struct megasas_instance *instance) +static int MR_PopulateDrvRaidMap(struct megasas_instance *instance) { struct fusion_context *fusion = instance->ctrl_context; struct MR_FW_RAID_MAP_ALL *fw_map_old = NULL; @@ -259,7 +259,7 @@ void MR_PopulateDrvRaidMap(struct megasa ld_count = (u16)le16_to_cpu(fw_map_ext->ldCount); if (ld_count > MAX_LOGICAL_DRIVES_EXT) { dev_dbg(&instance->pdev->dev, "megaraid_sas: LD count exposed in RAID map in not valid\n"); - return; + return 1; } pDrvRaidMap->ldCount = (__le16)cpu_to_le16(ld_count); @@ -285,6 +285,12 @@ void MR_PopulateDrvRaidMap(struct megasa fusion->ld_map[(instance->map_id & 1)]; pFwRaidMap = &fw_map_old->raidMap; ld_count = (u16)le32_to_cpu(pFwRaidMap->ldCount); + if (ld_count > MAX_LOGICAL_DRIVES) { + dev_dbg(&instance->pdev->dev, + "LD count exposed in RAID map in not valid\n"); + return 1; + } + pDrvRaidMap->totalSize = pFwRaidMap->totalSize; pDrvRaidMap->ldCount = (__le16)cpu_to_le16(ld_count); pDrvRaidMap->fpPdIoTimeoutSec = pFwRaidMap->fpPdIoTimeoutSec; @@ -300,6 +306,8 @@ void MR_PopulateDrvRaidMap(struct megasa sizeof(struct MR_DEV_HANDLE_INFO) * MAX_RAIDMAP_PHYSICAL_DEVICES); } + + return 0; } /* @@ -317,8 +325,8 @@ u8 MR_ValidateMapInfo(struct megasas_ins u16 ld; u32 expected_size; - - MR_PopulateDrvRaidMap(instance); + if (MR_PopulateDrvRaidMap(instance)) + return 0; fusion = instance->ctrl_context; drv_map = fusion->ld_drv_map[(instance->map_id & 1)];