From patchwork Mon Aug 5 13:48:03 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Garry X-Patchwork-Id: 170569 Delivered-To: patch@linaro.org Received: by 2002:a92:512:0:0:0:0:0 with SMTP id q18csp4322773ile; Mon, 5 Aug 2019 06:51:26 -0700 (PDT) X-Google-Smtp-Source: APXvYqy51YsB3i4EI+UtU2MuaVbGhbcJIA4ISMEAD83W2GVbzY03TrrrB+nkMnuGzyI9AsGZpJiH X-Received: by 2002:aa7:9514:: with SMTP id b20mr74886544pfp.223.1565013086466; Mon, 05 Aug 2019 06:51:26 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1565013086; cv=none; d=google.com; s=arc-20160816; b=WVd8BTnETAD6n74sJmO3NTE7lBV+SyRlvyuD0lgisItJQatuQ8PufF0CAPVGL5bTUB 9zElj34UJMD1LgVCB7c8oTbMXBusTr3W1eZjuR8exK/U/WWALLTO8ESZh931lBHHHYqk +x5SpU99VMedH9pClUTBwPgYtqo9ftGfL8SeIBkxWrev3I296pqbuAEEpXlpHfL6PSWK /COeR8f/DEQ4IVyfeeESlt9yfJuxsyqmwVwvZ0Fk05cm1wi9gk+Dnwz/Pajr4JOpF99g VkUhKCslKucycTxFcFhYSbvEOgUSTwU66M4Ig/A8sVAs5WV6ID7fM1MH49xe1jcOt+1o tR9w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from; bh=KwEy6xoV6bjbhye/nwPcz3PCTH+vHkKCoyQ8e4uYDik=; b=l890S48lbL00H4SP8OlO+z6hbePUq6GYwiveCoLM4gCgE8YCEGlDMl8SWdGLIDSmz+ pzHU+hlsA2104csv5rfYV6icRTeS87esZ/3LTXtp5/se3Ygpj1O4Qfeqx2vasYOCEmmL psemRsZEUIKqSs1PCboPKNgnMJHdv+KKjJa540qZBOOKqh+gET6wfx8ugr3myiRMpLRM gXUHHKJ2mZnPgOFuAhDnLBHpYCNbixCvflwUVFOoP3TiyRgvde9d9ymsKtvgHFBoIWuM 3f7uy4aVXhDKFl3s5rRD+PwiPufDNsBLmaEgBkxmKcSOO1zDhPKkoXQmtN080HHirDCb W1iw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id 6si40509487plb.345.2019.08.05.06.51.26; Mon, 05 Aug 2019 06:51:26 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730816AbfHENvZ (ORCPT + 29 others); Mon, 5 Aug 2019 09:51:25 -0400 Received: from szxga07-in.huawei.com ([45.249.212.35]:44502 "EHLO huawei.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1728690AbfHENu0 (ORCPT ); Mon, 5 Aug 2019 09:50:26 -0400 Received: from DGGEMS408-HUB.china.huawei.com (unknown [172.30.72.59]) by Forcepoint Email with ESMTP id 0D823BC74230D4495B06; Mon, 5 Aug 2019 21:50:24 +0800 (CST) Received: from localhost.localdomain (10.67.212.75) by DGGEMS408-HUB.china.huawei.com (10.3.19.208) with Microsoft SMTP Server id 14.3.439.0; Mon, 5 Aug 2019 21:50:13 +0800 From: John Garry To: , CC: , , , Luo Jiaxing , John Garry Subject: [PATCH 06/15] scsi: hisi_sas: Fix out of bound at debug_I_T_nexus_reset() Date: Mon, 5 Aug 2019 21:48:03 +0800 Message-ID: <1565012892-75940-7-git-send-email-john.garry@huawei.com> X-Mailer: git-send-email 2.8.1 In-Reply-To: <1565012892-75940-1-git-send-email-john.garry@huawei.com> References: <1565012892-75940-1-git-send-email-john.garry@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.67.212.75] X-CFilter-Loop: Reflected Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Luo Jiaxing Fix a possible out-of-bounds access in hisi_sas_debug_I_T_nexus_reset(). Signed-off-by: Luo Jiaxing Signed-off-by: John Garry --- drivers/scsi/hisi_sas/hisi_sas_main.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) -- 2.17.1 diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c index 04b3b0040059..02ad91c01a44 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_main.c +++ b/drivers/scsi/hisi_sas/hisi_sas_main.c @@ -1762,13 +1762,14 @@ static int hisi_sas_debug_I_T_nexus_reset(struct domain_device *device) struct hisi_sas_device *sas_dev = device->lldd_dev; struct hisi_hba *hisi_hba = dev_to_hisi_hba(device); struct sas_ha_struct *sas_ha = &hisi_hba->sha; - struct asd_sas_phy *sas_phy = sas_ha->sas_phy[local_phy->number]; - struct hisi_sas_phy *phy = container_of(sas_phy, - struct hisi_sas_phy, sas_phy); DECLARE_COMPLETION_ONSTACK(phyreset); int rc, reset_type; if (scsi_is_sas_phy_local(local_phy)) { + struct asd_sas_phy *sas_phy = + sas_ha->sas_phy[local_phy->number]; + struct hisi_sas_phy *phy = + container_of(sas_phy, struct hisi_sas_phy, sas_phy); phy->in_reset = 1; phy->reset_completion = &phyreset; } @@ -1780,6 +1781,10 @@ static int hisi_sas_debug_I_T_nexus_reset(struct domain_device *device) sas_put_local_phy(local_phy); if (scsi_is_sas_phy_local(local_phy)) { + struct asd_sas_phy *sas_phy = + sas_ha->sas_phy[local_phy->number]; + struct hisi_sas_phy *phy = + container_of(sas_phy, struct hisi_sas_phy, sas_phy); int ret = wait_for_completion_timeout(&phyreset, 2 * HZ); unsigned long flags;