From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
patches@lists.linux.dev,
Kai-Heng Feng <kai.heng.feng@canonical.com>,
Damien Le Moal <damien.lemoal@opensource.wdc.com>
Subject: [PATCH 5.15 20/79] ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS
Date: Thu, 27 Oct 2022 18:55:18 +0200 [thread overview]
Message-ID: <20221027165055.625310306@linuxfoundation.org> (raw)
In-Reply-To: <20221027165054.917467648@linuxfoundation.org>
From: Kai-Heng Feng <kai.heng.feng@canonical.com>
commit 1e41e693f458eef2d5728207dbd327cd3b16580a upstream.
UBSAN complains about array-index-out-of-bounds:
[ 1.980703] kernel: UBSAN: array-index-out-of-bounds in /build/linux-9H675w/linux-5.15.0/drivers/ata/libahci.c:968:41
[ 1.980709] kernel: index 15 is out of range for type 'ahci_em_priv [8]'
[ 1.980713] kernel: CPU: 0 PID: 209 Comm: scsi_eh_8 Not tainted 5.15.0-25-generic #25-Ubuntu
[ 1.980716] kernel: Hardware name: System manufacturer System Product Name/P5Q3, BIOS 1102 06/11/2010
[ 1.980718] kernel: Call Trace:
[ 1.980721] kernel: <TASK>
[ 1.980723] kernel: show_stack+0x52/0x58
[ 1.980729] kernel: dump_stack_lvl+0x4a/0x5f
[ 1.980734] kernel: dump_stack+0x10/0x12
[ 1.980736] kernel: ubsan_epilogue+0x9/0x45
[ 1.980739] kernel: __ubsan_handle_out_of_bounds.cold+0x44/0x49
[ 1.980742] kernel: ahci_qc_issue+0x166/0x170 [libahci]
[ 1.980748] kernel: ata_qc_issue+0x135/0x240
[ 1.980752] kernel: ata_exec_internal_sg+0x2c4/0x580
[ 1.980754] kernel: ? vprintk_default+0x1d/0x20
[ 1.980759] kernel: ata_exec_internal+0x67/0xa0
[ 1.980762] kernel: sata_pmp_read+0x8d/0xc0
[ 1.980765] kernel: sata_pmp_read_gscr+0x3c/0x90
[ 1.980768] kernel: sata_pmp_attach+0x8b/0x310
[ 1.980771] kernel: ata_eh_revalidate_and_attach+0x28c/0x4b0
[ 1.980775] kernel: ata_eh_recover+0x6b6/0xb30
[ 1.980778] kernel: ? ahci_do_hardreset+0x180/0x180 [libahci]
[ 1.980783] kernel: ? ahci_stop_engine+0xb0/0xb0 [libahci]
[ 1.980787] kernel: ? ahci_do_softreset+0x290/0x290 [libahci]
[ 1.980792] kernel: ? trace_event_raw_event_ata_eh_link_autopsy_qc+0xe0/0xe0
[ 1.980795] kernel: sata_pmp_eh_recover.isra.0+0x214/0x560
[ 1.980799] kernel: sata_pmp_error_handler+0x23/0x40
[ 1.980802] kernel: ahci_error_handler+0x43/0x80 [libahci]
[ 1.980806] kernel: ata_scsi_port_error_handler+0x2b1/0x600
[ 1.980810] kernel: ata_scsi_error+0x9c/0xd0
[ 1.980813] kernel: scsi_error_handler+0xa1/0x180
[ 1.980817] kernel: ? scsi_unjam_host+0x1c0/0x1c0
[ 1.980820] kernel: kthread+0x12a/0x150
[ 1.980823] kernel: ? set_kthread_struct+0x50/0x50
[ 1.980826] kernel: ret_from_fork+0x22/0x30
[ 1.980831] kernel: </TASK>
This happens because sata_pmp_init_links() initialize link->pmp up to
SATA_PMP_MAX_PORTS while em_priv is declared as 8 elements array.
I can't find the maximum Enclosure Management ports specified in AHCI
spec v1.3.1, but "12.2.1 LED message type" states that "Port Multiplier
Information" can utilize 4 bits, which implies it can support up to 16
ports. Hence, use SATA_PMP_MAX_PORTS as EM_MAX_SLOTS to resolve the
issue.
BugLink: https://bugs.launchpad.net/bugs/1970074
Cc: stable@vger.kernel.org
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/ahci.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/ata/ahci.h
+++ b/drivers/ata/ahci.h
@@ -254,7 +254,7 @@ enum {
PCS_7 = 0x94, /* 7+ port PCS (Denverton) */
/* em constants */
- EM_MAX_SLOTS = 8,
+ EM_MAX_SLOTS = SATA_PMP_MAX_PORTS,
EM_MAX_RETRY = 5,
/* em_ctl bits */
next prev parent reply other threads:[~2022-10-27 17:01 UTC|newest]
Thread overview: 86+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-10-27 16:54 [PATCH 5.15 00/79] 5.15.76-rc1 review Greg Kroah-Hartman
2022-10-27 16:54 ` [PATCH 5.15 01/79] r8152: add PID for the Lenovo OneLink+ Dock Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 02/79] arm64/mm: Consolidate TCR_EL1 fields Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 03/79] usb: gadget: uvc: consistently use define for headerlen Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 04/79] usb: gadget: uvc: use on returned header len in video_encode_isoc_sg Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 05/79] usb: gadget: uvc: rework uvcg_queue_next_buffer to uvcg_complete_buffer Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 06/79] usb: gadget: uvc: giveback vb2 buffer on req complete Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 07/79] usb: gadget: uvc: improve sg exit condition Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 08/79] arm64: errata: Remove AES hwcap for COMPAT tasks Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 09/79] perf/x86/intel/pt: Relax address filter validation Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 10/79] btrfs: enhance unsupported compat RO flags handling Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 11/79] ocfs2: clear dinode links count in case of error Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 12/79] ocfs2: fix BUG when iput after ocfs2_mknod fails Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 13/79] selinux: enable use of both GFP_KERNEL and GFP_ATOMIC in convert_context() Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 14/79] cpufreq: qcom: fix writes in read-only memory region Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 15/79] i2c: qcom-cci: Fix ordering of pm_runtime_xx and i2c_add_adapter Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 16/79] cpufreq: tegra194: Fix module loading Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 17/79] x86/microcode/AMD: Apply the patch early on every logical thread Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 18/79] hwmon/coretemp: Handle large core ID value Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 19/79] ata: ahci-imx: Fix MODULE_ALIAS Greg Kroah-Hartman
2022-10-27 16:55 ` Greg Kroah-Hartman [this message]
2022-10-27 16:55 ` [PATCH 5.15 21/79] x86/resctrl: Fix min_cbm_bits for AMD Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 22/79] cpufreq: qcom: fix memory leak in error path Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 23/79] drm/amdgpu: fix sdma doorbell init ordering on APUs Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 24/79] mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 25/79] kvm: Add support for arch compat vm ioctls Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 26/79] KVM: arm64: vgic: Fix exit condition in scan_its_table() Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 27/79] media: ipu3-imgu: Fix NULL pointer dereference in active selection access Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 28/79] media: mceusb: set timeout to at least timeout provided Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 29/79] media: venus: dec: Handle the case where find_format fails Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 30/79] x86/topology: Fix multiple packages shown on a single-package system Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 31/79] x86/topology: Fix duplicated core ID within a package Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 32/79] btrfs: fix processing of delayed data refs during backref walking Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 33/79] btrfs: fix processing of delayed tree block " Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 34/79] drm/vc4: Add module dependency on hdmi-codec Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 35/79] ACPI: extlog: Handle multiple records Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 36/79] tipc: Fix recognition of trial period Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 37/79] tipc: fix an information leak in tipc_topsrv_kern_subscr Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 38/79] i40e: Fix DMA mappings leak Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 39/79] HID: magicmouse: Do not set BTN_MOUSE on double report Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 40/79] sfc: Change VF mac via PF as first preference if available Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 41/79] net/atm: fix proc_mpc_write incorrect return value Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 42/79] net: phy: dp83867: Extend RX strap quirk for SGMII mode Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 43/79] net: phylink: add mac_managed_pm in phylink_config structure Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 44/79] scsi: lpfc: Fix memory leak in lpfc_create_port() Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 45/79] udp: Update reuse->has_conns under reuseport_lock Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 46/79] cifs: Fix xid leak in cifs_create() Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 47/79] cifs: Fix xid leak in cifs_copy_file_range() Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 48/79] cifs: Fix xid leak in cifs_flock() Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 49/79] cifs: Fix xid leak in cifs_ses_add_channel() Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 50/79] dm: remove unnecessary assignment statement in alloc_dev() Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 51/79] net: hsr: avoid possible NULL deref in skb_clone() Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 52/79] ionic: catch NULL pointer issue on reconfig Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 53/79] netfilter: nf_tables: relax NFTA_SET_ELEM_KEY_END set flags requirements Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 54/79] nvme-hwmon: consistently ignore errors from nvme_hwmon_init Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 55/79] nvme-hwmon: kmalloc the NVME SMART log buffer Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 56/79] nvmet: fix workqueue MEM_RECLAIM flushing dependency Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 57/79] net: sched: cake: fix null pointer access issue when cake_init() fails Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 58/79] net: sched: delete duplicate cleanup of backlog and qlen Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 59/79] net: sched: sfb: fix null pointer access issue when sfb_init() fails Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 60/79] sfc: include vport_id in filter spec hash and equal() Greg Kroah-Hartman
2022-10-27 16:55 ` [PATCH 5.15 61/79] wwan_hwsim: fix possible memory leak in wwan_hwsim_dev_new() Greg Kroah-Hartman
2022-10-27 16:56 ` [PATCH 5.15 62/79] net: hns: fix possible memory leak in hnae_ae_register() Greg Kroah-Hartman
2022-10-27 16:56 ` [PATCH 5.15 63/79] net: sched: fix race condition in qdisc_graft() Greg Kroah-Hartman
2022-10-27 16:56 ` [PATCH 5.15 64/79] net: phy: dp83822: disable MDI crossover status change interrupt Greg Kroah-Hartman
2022-10-27 16:56 ` [PATCH 5.15 65/79] iommu/vt-d: Allow NVS regions in arch_rmrr_sanity_check() Greg Kroah-Hartman
2022-10-27 16:56 ` [PATCH 5.15 66/79] iommu/vt-d: Clean up si_domain in the init_dmars() error path Greg Kroah-Hartman
2022-10-27 16:56 ` [PATCH 5.15 67/79] fs: dlm: fix invalid derefence of sb_lvbptr Greg Kroah-Hartman
2022-10-27 16:56 ` [PATCH 5.15 68/79] arm64: mte: move register initialization to C Greg Kroah-Hartman
2022-10-27 16:56 ` [PATCH 5.15 69/79] ksmbd: handle smb2 query dir request for OutputBufferLength that is too small Greg Kroah-Hartman
2022-10-27 16:56 ` [PATCH 5.15 70/79] ksmbd: fix incorrect handling of iterate_dir Greg Kroah-Hartman
2022-10-27 16:56 ` [PATCH 5.15 71/79] tracing: Simplify conditional compilation code in tracing_set_tracer() Greg Kroah-Hartman
2022-10-27 16:56 ` [PATCH 5.15 72/79] tracing: Do not free snapshot if tracer is on cmdline Greg Kroah-Hartman
2022-10-27 16:56 ` [PATCH 5.15 73/79] mmc: sdhci-tegra: Use actual clock rate for SW tuning correction Greg Kroah-Hartman
2022-10-27 16:56 ` [PATCH 5.15 74/79] perf: Skip and warn on unknown format configN attrs Greg Kroah-Hartman
2022-10-27 16:56 ` [PATCH 5.15 75/79] [PATCH v3] ACPI: video: Force backlight native for more TongFang devices Greg Kroah-Hartman
2022-10-27 16:56 ` [PATCH 5.15 76/79] x86/Kconfig: Drop check for -mabi=ms for CONFIG_EFI_STUB Greg Kroah-Hartman
2022-10-27 16:56 ` [PATCH 5.15 77/79] Makefile.debug: re-enable debug info for .S files Greg Kroah-Hartman
2022-10-27 16:56 ` [PATCH 5.15 78/79] mmc: core: Add SD card quirk for broken discard Greg Kroah-Hartman
2022-10-27 16:56 ` [PATCH 5.15 79/79] mm: /proc/pid/smaps_rollup: fix no vmas null-deref Greg Kroah-Hartman
2022-10-27 18:18 ` [PATCH 5.15 00/79] 5.15.76-rc1 review Guenter Roeck
2022-10-28 10:42 ` Greg Kroah-Hartman
2022-10-28 3:46 ` Bagas Sanjaya
2022-10-28 9:58 ` Naresh Kamboju
2022-10-28 10:40 ` Sudip Mukherjee (Codethink)
2022-10-28 10:44 ` Sudip Mukherjee
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221027165055.625310306@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=damien.lemoal@opensource.wdc.com \
--cc=kai.heng.feng@canonical.com \
--cc=patches@lists.linux.dev \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).