From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-co1nam03on0101.outbound.protection.outlook.com ([104.47.40.101]:4252 "EHLO NAM03-CO1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1728112AbeIBRbR (ORCPT ); Sun, 2 Sep 2018 13:31:17 -0400 From: Sasha Levin To: "stable@vger.kernel.org" , "linux-kernel@vger.kernel.org" CC: Mauricio Faria de Oliveira , Jens Axboe , Sasha Levin Subject: [PATCH AUTOSEL 4.9 44/62] partitions/aix: fix usage of uninitialized lv_info and lvname structures Date: Sun, 2 Sep 2018 13:14:58 +0000 Message-ID: <20180902131411.183978-34-alexander.levin@microsoft.com> References: <20180902131411.183978-1-alexander.levin@microsoft.com> In-Reply-To: <20180902131411.183978-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org List-ID: From: Mauricio Faria de Oliveira [ Upstream commit 14cb2c8a6c5dae57ee3e2da10fa3db2b9087e39e ] The if-block that sets a successful return value in aix_partition() uses 'lvip[].pps_per_lv' and 'n[].name' potentially uninitialized. For example, if 'numlvs' is zero or alloc_lvn() fails, neither is initialized, but are used anyway if alloc_pvd() succeeds after it. So, make the alloc_pvd() call conditional on their initialization. This has been hit when attaching an apparently corrupted/stressed AIX LUN, misleading the kernel to pr_warn() invalid data and hang. [...] partition (null) (11 pp's found) is not contiguous [...] partition (null) (2 pp's found) is not contiguous [...] partition (null) (3 pp's found) is not contiguous [...] partition (null) (64 pp's found) is not contiguous Fixes: 6ceea22bbbc8 ("partitions: add aix lvm partition support files") Signed-off-by: Mauricio Faria de Oliveira Signed-off-by: Jens Axboe Signed-off-by: Sasha Levin --- block/partitions/aix.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/block/partitions/aix.c b/block/partitions/aix.c index fa74698e12a6..8e7d358e0226 100644 --- a/block/partitions/aix.c +++ b/block/partitions/aix.c @@ -177,7 +177,7 @@ int aix_partition(struct parsed_partitions *state) u32 vgda_sector =3D 0; u32 vgda_len =3D 0; int numlvs =3D 0; - struct pvd *pvd; + struct pvd *pvd =3D NULL; struct lv_info { unsigned short pps_per_lv; unsigned short pps_found; @@ -231,10 +231,11 @@ int aix_partition(struct parsed_partitions *state) if (lvip[i].pps_per_lv) foundlvs +=3D 1; } + /* pvd loops depend on n[].name and lvip[].pps_per_lv */ + pvd =3D alloc_pvd(state, vgda_sector + 17); } put_dev_sector(sect); } - pvd =3D alloc_pvd(state, vgda_sector + 17); if (pvd) { int numpps =3D be16_to_cpu(pvd->pp_count); int psn_part1 =3D be32_to_cpu(pvd->psn_part1); --=20 2.17.1