From patchwork Tue Jul 25 20:45:16 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amit Pundir X-Patchwork-Id: 108701 Delivered-To: patch@linaro.org Received: by 10.140.101.44 with SMTP id t41csp28802qge; Tue, 25 Jul 2017 13:45:50 -0700 (PDT) X-Received: by 10.84.228.214 with SMTP id y22mr23293999pli.245.1501015550059; Tue, 25 Jul 2017 13:45:50 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1501015550; cv=none; d=google.com; s=arc-20160816; b=jfm3c7VR466QgW0fZgDS3hVHJ6atrE332xmdXae+Nw51Q+OYFs1vUIMlG8KtlG0wnl Y7kIGb044qskrGOjkRiYO3//uF1w+OTVisnU7xd4s2NQm2/X+t1POcXQOX5BsM3TR4k6 +/JCzGsnUY96ORKREcvcVEXmfUJ7n6xq8ne8p8xc+RhLp3PEJs1xw3PxvHRGKFLjl4vh yL9An5xUmj53sMYgsvYSds/EYgeVjYWa/pnX8rmKiqtm9ssVMg2CEl+WBOJZ+y0/VDxW JFSLhRZYMFgpog5Vn3hx2l1exhyAYTVQ//qvhSNO/zsLgAbv6Bm+Dvl3c/YQlItNTFnT iVnQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:dkim-signature:arc-authentication-results; bh=+pg1zUjLAQatmjpgokwwmEnkdmkGcyZPboPg0FvpHZU=; b=HTOax12WgxNQXQ/SYzaMjT+Vo2zQeI566ffeJlXUrjKcw5+lpYKM2K/S2NpPoV9rWn GSiOPRJJ3NftEoWay1iv8nbDdpsHXaX9vaAgyL9OGji2HfsB+IQzCm86xC1q798+GGW8 bfqcH3gTm3Pth4/Ub9WUbCJ8N8H+gzK1XpGr70hc3OPmZnz0VbyF08qm5zGU8aIP2Mrt A9NZXZZ1xNasKNXjbPkLlUe3ZtkIANJ80kq/aPAx7KWF0tQpf4ruh9Ftm33fhCGjT+pU ttZaC5NTGpb2EBs/tQnRJFrLWVoVjDYuS6LAohj0d/J0klX5AjYCbt8wMCydAu4JsJk9 BcbQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.b=g0DTuuiF; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id u1si9102153plm.762.2017.07.25.13.45.49; Tue, 25 Jul 2017 13:45:50 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.b=g0DTuuiF; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751609AbdGYUps (ORCPT + 6 others); Tue, 25 Jul 2017 16:45:48 -0400 Received: from mail-pf0-f178.google.com ([209.85.192.178]:34155 "EHLO mail-pf0-f178.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752664AbdGYUpr (ORCPT ); Tue, 25 Jul 2017 16:45:47 -0400 Received: by mail-pf0-f178.google.com with SMTP id q85so62646903pfq.1 for ; Tue, 25 Jul 2017 13:45:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=+pg1zUjLAQatmjpgokwwmEnkdmkGcyZPboPg0FvpHZU=; b=g0DTuuiFS63pBb/+LSwIG8P9VsLd0qgus/iFFWD/fZWVOjOY9d2DugA3fWtkDRaDcW z3DsvBdY+NHmWZdFgj00Mx8h3T0eRL5IiKw3hGqvFQoFaTUa56ZdEAsOJY0iV8Ewi2o6 Kf96Crn63TppyzJvw5ZjAODsDRX1QfWwUthio= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=+pg1zUjLAQatmjpgokwwmEnkdmkGcyZPboPg0FvpHZU=; b=Q7H31e8CBGhsWocONhbKQZis/fiDAHc5K9bzLBWEf15zpgF9TP5QkCT0Z1oyoyJVgj rKQuUm97qmsBViJTHGnt/jK8Uwr4WiNlZrLJcJmwHtwejg77d1U/o63NjZABQjvPHFDg SklLQZ7UjjWtcE7pZNCMZ9bOITf/X3AqBspnpsG9k8b0NHLzgoVwci67WdbrB994/+zK jOo58yWiga+3AdOa4eSij3N2fm8k1mjdCJQr6LtrK/86FDhEThgW6skfXEm8f1J7BtpT P5P3FUQ0ViPLlY0C/yUGfNuVMkgFtXi5EjMfyKSJIzOeYS5EhpEPf9imz4sb8eWe2JqR UYtg== X-Gm-Message-State: AIVw112kS+ul4r3Hob1jEbsoYiyaDXYaoPq+18/Vm2IGt3skKrq0HQny s5CwCrvIm5S85CeG X-Received: by 10.98.202.214 with SMTP id y83mr20979725pfk.2.1501015546324; Tue, 25 Jul 2017 13:45:46 -0700 (PDT) Received: from localhost.localdomain ([106.51.135.235]) by smtp.gmail.com with ESMTPSA id d4sm532125pfj.59.2017.07.25.13.45.43 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 25 Jul 2017 13:45:45 -0700 (PDT) From: Amit Pundir To: Greg KH Cc: Stable , Calvin Owens , "Martin K . Petersen" Subject: [PATCH for-3.18 05/15] mpt3sas: Don't overreach ioc->reply_post[] during initialization Date: Wed, 26 Jul 2017 02:15:16 +0530 Message-Id: <1501015526-32178-6-git-send-email-amit.pundir@linaro.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1501015526-32178-1-git-send-email-amit.pundir@linaro.org> References: <1501015526-32178-1-git-send-email-amit.pundir@linaro.org> Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Calvin Owens commit 5ec8a1753bc29efa7e4b1391d691c9c719b30257 upstream. In _base_make_ioc_operational(), we walk ioc->reply_queue_list and pull a pointer out of successive elements of ioc->reply_post[] for each entry in that list if RDPQ is enabled. Since the code pulls the pointer for the next iteration at the bottom of the loop, it triggers the a KASAN dump on the final iteration: BUG: KASAN: slab-out-of-bounds in _base_make_ioc_operational+0x47b7/0x47e0 [mpt3sas] at addr ffff880754816ab0 Read of size 8 by task modprobe/305 Call Trace: [] dump_stack+0x4d/0x6c [] print_trailer+0xf9/0x150 [] object_err+0x34/0x40 [] kasan_report_error+0x221/0x530 [] __asan_report_load8_noabort+0x43/0x50 [] _base_make_ioc_operational+0x47b7/0x47e0 [mpt3sas] [] mpt3sas_base_attach+0x1991/0x2120 [mpt3sas] [] _scsih_probe+0xeb3/0x16b0 [mpt3sas] [] local_pci_probe+0xc7/0x170 [] pci_device_probe+0x20f/0x290 [] really_probe+0x17d/0x600 [] __driver_attach+0x153/0x190 [] bus_for_each_dev+0x11c/0x1a0 [] driver_attach+0x3d/0x50 [] bus_add_driver+0x44a/0x5f0 [] driver_register+0x18c/0x3b0 [] __pci_register_driver+0x156/0x200 [] _mpt3sas_init+0x135/0x1000 [mpt3sas] [] do_one_initcall+0x113/0x2b0 [] do_init_module+0x1d0/0x4d8 [] load_module+0x6729/0x8dc0 [] SYSC_init_module+0x183/0x1a0 [] SyS_init_module+0xe/0x10 [] entry_SYSCALL_64_fastpath+0x12/0x6a Fix this by pulling the value at the beginning of the loop. Signed-off-by: Calvin Owens Reviewed-by: Johannes Thumshirn Reviewed-by: Jens Axboe Acked-by: Chaitra Basappa Signed-off-by: Martin K. Petersen Signed-off-by: Amit Pundir --- drivers/scsi/mpt3sas/mpt3sas_base.c | 33 ++++++++++++++++----------------- 1 file changed, 16 insertions(+), 17 deletions(-) -- 2.7.4 diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 1560115079c7..52d409408aa3 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -4378,14 +4378,13 @@ _base_make_ioc_ready(struct MPT3SAS_ADAPTER *ioc, int sleep_flag, static int _base_make_ioc_operational(struct MPT3SAS_ADAPTER *ioc, int sleep_flag) { - int r, i; + int r, i, index; unsigned long flags; u32 reply_address; u16 smid; struct _tr_list *delayed_tr, *delayed_tr_next; struct adapter_reply_queue *reply_q; - long reply_post_free; - u32 reply_post_free_sz, index = 0; + Mpi2ReplyDescriptorsUnion_t *reply_post_free_contig; dinitprintk(ioc, pr_info(MPT3SAS_FMT "%s\n", ioc->name, __func__)); @@ -4456,27 +4455,27 @@ _base_make_ioc_operational(struct MPT3SAS_ADAPTER *ioc, int sleep_flag) _base_assign_reply_queues(ioc); /* initialize Reply Post Free Queue */ - reply_post_free_sz = ioc->reply_post_queue_depth * - sizeof(Mpi2DefaultReplyDescriptor_t); - reply_post_free = (long)ioc->reply_post[index].reply_post_free; + index = 0; + reply_post_free_contig = ioc->reply_post[0].reply_post_free; list_for_each_entry(reply_q, &ioc->reply_queue_list, list) { + /* + * If RDPQ is enabled, switch to the next allocation. + * Otherwise advance within the contiguous region. + */ + if (ioc->rdpq_array_enable) { + reply_q->reply_post_free = + ioc->reply_post[index++].reply_post_free; + } else { + reply_q->reply_post_free = reply_post_free_contig; + reply_post_free_contig += ioc->reply_post_queue_depth; + } + reply_q->reply_post_host_index = 0; - reply_q->reply_post_free = (Mpi2ReplyDescriptorsUnion_t *) - reply_post_free; for (i = 0; i < ioc->reply_post_queue_depth; i++) reply_q->reply_post_free[i].Words = cpu_to_le64(ULLONG_MAX); if (!_base_is_controller_msix_enabled(ioc)) goto skip_init_reply_post_free_queue; - /* - * If RDPQ is enabled, switch to the next allocation. - * Otherwise advance within the contiguous region. - */ - if (ioc->rdpq_array_enable) - reply_post_free = (long) - ioc->reply_post[++index].reply_post_free; - else - reply_post_free += reply_post_free_sz; } skip_init_reply_post_free_queue: