* [PATCH] scsi: aacraid: error: testing array offset 'bus' after use
@ 2017-09-13 8:46 Nikola Pajkovsky
2017-09-15 20:13 ` Dave Carroll
2017-09-16 1:46 ` Martin K. Petersen
0 siblings, 2 replies; 3+ messages in thread
From: Nikola Pajkovsky @ 2017-09-13 8:46 UTC (permalink / raw)
To: Adaptec OEM Raid Solutions
Cc: Hannes Reinecke, James E.J. Bottomley, Martin K. Petersen,
linux-scsi, linux-kernel
Fix possible indexing array of bound for &aac->hba_map[bus][cid],
where bus and cid boundary check happens later.
Fixes: 0d643ff3c353 ("scsi: aacraid: use aac_tmf_callback for reset fib")
Signed-off-by: Nikola Pajkovsky <npajkovsky@suse.cz>
---
drivers/scsi/aacraid/linit.c | 20 ++++++++++++--------
1 file changed, 12 insertions(+), 8 deletions(-)
diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
index 87cc4a93e637..62beb2596466 100644
--- a/drivers/scsi/aacraid/linit.c
+++ b/drivers/scsi/aacraid/linit.c
@@ -906,12 +906,14 @@ static int aac_eh_dev_reset(struct scsi_cmnd *cmd)
bus = aac_logical_to_phys(scmd_channel(cmd));
cid = scmd_id(cmd);
- info = &aac->hba_map[bus][cid];
- if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS ||
- info->devtype != AAC_DEVTYPE_NATIVE_RAW)
+
+ if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS)
return FAILED;
- if (info->reset_state > 0)
+ info = &aac->hba_map[bus][cid];
+
+ if (info->devtype != AAC_DEVTYPE_NATIVE_RAW &&
+ info->reset_state > 0)
return FAILED;
pr_err("%s: Host adapter reset request. SCSI hang ?\n",
@@ -962,12 +964,14 @@ static int aac_eh_target_reset(struct scsi_cmnd *cmd)
bus = aac_logical_to_phys(scmd_channel(cmd));
cid = scmd_id(cmd);
- info = &aac->hba_map[bus][cid];
- if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS ||
- info->devtype != AAC_DEVTYPE_NATIVE_RAW)
+
+ if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS)
return FAILED;
- if (info->reset_state > 0)
+ info = &aac->hba_map[bus][cid];
+
+ if (info->devtype != AAC_DEVTYPE_NATIVE_RAW &&
+ info->reset_state > 0)
return FAILED;
pr_err("%s: Host adapter reset request. SCSI hang ?\n",
--
2.13.5
^ permalink raw reply related [flat|nested] 3+ messages in thread
* RE: [PATCH] scsi: aacraid: error: testing array offset 'bus' after use
2017-09-13 8:46 [PATCH] scsi: aacraid: error: testing array offset 'bus' after use Nikola Pajkovsky
@ 2017-09-15 20:13 ` Dave Carroll
2017-09-16 1:46 ` Martin K. Petersen
1 sibling, 0 replies; 3+ messages in thread
From: Dave Carroll @ 2017-09-15 20:13 UTC (permalink / raw)
To: Nikola Pajkovsky, dl-esc-Aacraid Linux Driver
Cc: Hannes Reinecke, James E.J. Bottomley, Martin K. Petersen,
linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org
>
> Fix possible indexing array of bound for &aac->hba_map[bus][cid], where bus
> and cid boundary check happens later.
>
> Fixes: 0d643ff3c353 ("scsi: aacraid: use aac_tmf_callback for reset fib")
> Signed-off-by: Nikola Pajkovsky <npajkovsky@suse.cz>
> ---
> drivers/scsi/aacraid/linit.c | 20 ++++++++++++--------
> 1 file changed, 12 insertions(+), 8 deletions(-)
Reviewed-by: Dave Carroll <david.carroll@microsemi.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] scsi: aacraid: error: testing array offset 'bus' after use
2017-09-13 8:46 [PATCH] scsi: aacraid: error: testing array offset 'bus' after use Nikola Pajkovsky
2017-09-15 20:13 ` Dave Carroll
@ 2017-09-16 1:46 ` Martin K. Petersen
1 sibling, 0 replies; 3+ messages in thread
From: Martin K. Petersen @ 2017-09-16 1:46 UTC (permalink / raw)
To: Nikola Pajkovsky
Cc: Adaptec OEM Raid Solutions, Hannes Reinecke, James E.J. Bottomley,
Martin K. Petersen, linux-scsi, linux-kernel
Nikola,
> Fix possible indexing array of bound for &aac->hba_map[bus][cid],
> where bus and cid boundary check happens later.
Applied to 4.14/scsi-fixes. Thanks!
--
Martin K. Petersen Oracle Linux Engineering
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-09-16 1:46 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-09-13 8:46 [PATCH] scsi: aacraid: error: testing array offset 'bus' after use Nikola Pajkovsky
2017-09-15 20:13 ` Dave Carroll
2017-09-16 1:46 ` Martin K. Petersen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox