From patchwork Tue Jul 25 20:07:10 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amit Pundir X-Patchwork-Id: 108684 Delivered-To: patch@linaro.org Received: by 10.182.45.195 with SMTP id p3csp14069obm; Tue, 25 Jul 2017 13:07:37 -0700 (PDT) X-Received: by 10.84.217.68 with SMTP id e4mr8157540plj.309.1501013257206; Tue, 25 Jul 2017 13:07:37 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1501013257; cv=none; d=google.com; s=arc-20160816; b=cGmd4mRo9Htxmmyu5D3TfzOBJJqQ+Ztto3kCB/yhSd/m6derhoit8zZa44LhsB7qsQ G9KxIlpelWCN7ZntnwYDhiuljnwz+JMVoGaIfzmdMhX0PmDOCVhbdbrrkjWCMQ5u/sLw mumN06Zu/OYPTihVMgS8QVn6Gr6GYOdJLgeu1VNEo9WDA+zW+58u65LV86cVNvZs6Y4G 5S/gBz2nzwGK7Xi8ZC39M5XU+iHZu+9yAHI7P8qeNkz+dzSAdpAIPtrP3wgqM3tZMKet dAzI0bBjCi/xFlHSvlPTpM4Ydk58PKr2eOxj9S9KQLuY3nWSsqoGjJwiJc+JbzoqJLLC Qaug== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:dkim-signature:arc-authentication-results; bh=nL1QEUYsr4+2EhmzKQZeCEOszg3QXsUwcPta1BzYu2M=; b=rcetUKC0d+I5vqcfOnhuMIl5+GBR2Fbka3dLzSYUxqZOVQ+i8KW5Yc3G6bBpgHwGzS 2Fj1hMoPJZiWE+HNKRXolJBTmoFrvZcyyzAONxRGeeK6wg0O+xT6vY36lYfHkZXAfBn6 tSdprwDCNcsOxKQKfn9zdXqFQc48b6v7ICx2e0dk7EX8ZiH1B+Zde4GgDsRVlAE6rXMP gRoMFJN7DvIYq/U518VRQ0wz2WB2L0kQQGSm0CsPtMsabHBapPQPWsYITBFNyyjSulPd /qpPEt+qKYfxNzVgQdiDkro4Kjb/lZpzD3w9URpQVhb8duiIGieINOTh8KhqE3ZfoR27 FHAQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.b=UN60x5uW; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id h10si8970990plk.237.2017.07.25.13.07.36; Tue, 25 Jul 2017 13:07:37 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.b=UN60x5uW; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753615AbdGYUHf (ORCPT + 6 others); Tue, 25 Jul 2017 16:07:35 -0400 Received: from mail-pf0-f179.google.com ([209.85.192.179]:33104 "EHLO mail-pf0-f179.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753612AbdGYUHe (ORCPT ); Tue, 25 Jul 2017 16:07:34 -0400 Received: by mail-pf0-f179.google.com with SMTP id s70so62309981pfs.0 for ; Tue, 25 Jul 2017 13:07:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=nL1QEUYsr4+2EhmzKQZeCEOszg3QXsUwcPta1BzYu2M=; b=UN60x5uW7PDd5ROvt1QAjbDattuJgy9m6BptOxR7RKsL+qa8ku96KHIGVf8c8l0bDu WuAlVi9Q50uHFjDjtDVE+3OlgA6i8zHOhkVk7AMI1MiOa2nQ1I3zPZOI2Fsekg0m55Ag 8sQPiMcpElyDsmXXiH0Q8EoK5zDASApDGUtCI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=nL1QEUYsr4+2EhmzKQZeCEOszg3QXsUwcPta1BzYu2M=; b=lBeeUQXKL1xRzSpyCuPYmchFr2ZY3eiUbwf7EOHDV9aoqzBCP7uclgUBt4RbYteJtI cdXyK5OmDVApq7lZgFAoHXVTtkvJujpSk9itmiMWjaw13lJgtB3k9uBpj5lFG46CTRsm 2r15hLEp0EhYHKsbP1CQ3n0Pc31eWmucgSB3/ujlTFZmWHF8csCyBojeaK4RIzbH9L67 YtWXb0TkThBbk+OnQthQZ/rj/HKYnMyX4Mt9OVU3JaapPbpCF8i5oy+GMYXtRqJZ7FxK oZFHDMwbjMHB9WBQBK05YyQHoJUBakt+wnec2Qm7CvjLe+d27pS8W5zQKKY5EkNnKqJM FvlA== X-Gm-Message-State: AIVw112poIuXtrDeJ3PHvBQ3EVkLEN0dmkvfv+yOjxGn0AJqD9a0WbT8 lQ1DNK0yniGrNA0h X-Received: by 10.84.194.37 with SMTP id g34mr22524472pld.111.1501013253236; Tue, 25 Jul 2017 13:07:33 -0700 (PDT) Received: from localhost.localdomain ([106.51.135.235]) by smtp.gmail.com with ESMTPSA id c76sm27684356pfj.91.2017.07.25.13.07.30 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 25 Jul 2017 13:07:32 -0700 (PDT) From: Amit Pundir To: Greg KH Cc: Stable , Calvin Owens , "Martin K . Petersen" Subject: [PATCH for-4.4 02/13] mpt3sas: Don't overreach ioc->reply_post[] during initialization Date: Wed, 26 Jul 2017 01:37:10 +0530 Message-Id: <1501013241-31961-3-git-send-email-amit.pundir@linaro.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1501013241-31961-1-git-send-email-amit.pundir@linaro.org> References: <1501013241-31961-1-git-send-email-amit.pundir@linaro.org> Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Calvin Owens commit 5ec8a1753bc29efa7e4b1391d691c9c719b30257 upstream. In _base_make_ioc_operational(), we walk ioc->reply_queue_list and pull a pointer out of successive elements of ioc->reply_post[] for each entry in that list if RDPQ is enabled. Since the code pulls the pointer for the next iteration at the bottom of the loop, it triggers the a KASAN dump on the final iteration: BUG: KASAN: slab-out-of-bounds in _base_make_ioc_operational+0x47b7/0x47e0 [mpt3sas] at addr ffff880754816ab0 Read of size 8 by task modprobe/305 Call Trace: [] dump_stack+0x4d/0x6c [] print_trailer+0xf9/0x150 [] object_err+0x34/0x40 [] kasan_report_error+0x221/0x530 [] __asan_report_load8_noabort+0x43/0x50 [] _base_make_ioc_operational+0x47b7/0x47e0 [mpt3sas] [] mpt3sas_base_attach+0x1991/0x2120 [mpt3sas] [] _scsih_probe+0xeb3/0x16b0 [mpt3sas] [] local_pci_probe+0xc7/0x170 [] pci_device_probe+0x20f/0x290 [] really_probe+0x17d/0x600 [] __driver_attach+0x153/0x190 [] bus_for_each_dev+0x11c/0x1a0 [] driver_attach+0x3d/0x50 [] bus_add_driver+0x44a/0x5f0 [] driver_register+0x18c/0x3b0 [] __pci_register_driver+0x156/0x200 [] _mpt3sas_init+0x135/0x1000 [mpt3sas] [] do_one_initcall+0x113/0x2b0 [] do_init_module+0x1d0/0x4d8 [] load_module+0x6729/0x8dc0 [] SYSC_init_module+0x183/0x1a0 [] SyS_init_module+0xe/0x10 [] entry_SYSCALL_64_fastpath+0x12/0x6a Fix this by pulling the value at the beginning of the loop. Signed-off-by: Calvin Owens Reviewed-by: Johannes Thumshirn Reviewed-by: Jens Axboe Acked-by: Chaitra Basappa Signed-off-by: Martin K. Petersen Signed-off-by: Amit Pundir --- drivers/scsi/mpt3sas/mpt3sas_base.c | 33 ++++++++++++++++----------------- 1 file changed, 16 insertions(+), 17 deletions(-) -- 2.7.4 diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 5b2c37f1e908..9b5367294116 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -4981,15 +4981,14 @@ _base_make_ioc_ready(struct MPT3SAS_ADAPTER *ioc, int sleep_flag, static int _base_make_ioc_operational(struct MPT3SAS_ADAPTER *ioc, int sleep_flag) { - int r, i; + int r, i, index; unsigned long flags; u32 reply_address; u16 smid; struct _tr_list *delayed_tr, *delayed_tr_next; u8 hide_flag; struct adapter_reply_queue *reply_q; - long reply_post_free; - u32 reply_post_free_sz, index = 0; + Mpi2ReplyDescriptorsUnion_t *reply_post_free_contig; dinitprintk(ioc, pr_info(MPT3SAS_FMT "%s\n", ioc->name, __func__)); @@ -5061,27 +5060,27 @@ _base_make_ioc_operational(struct MPT3SAS_ADAPTER *ioc, int sleep_flag) _base_assign_reply_queues(ioc); /* initialize Reply Post Free Queue */ - reply_post_free_sz = ioc->reply_post_queue_depth * - sizeof(Mpi2DefaultReplyDescriptor_t); - reply_post_free = (long)ioc->reply_post[index].reply_post_free; + index = 0; + reply_post_free_contig = ioc->reply_post[0].reply_post_free; list_for_each_entry(reply_q, &ioc->reply_queue_list, list) { + /* + * If RDPQ is enabled, switch to the next allocation. + * Otherwise advance within the contiguous region. + */ + if (ioc->rdpq_array_enable) { + reply_q->reply_post_free = + ioc->reply_post[index++].reply_post_free; + } else { + reply_q->reply_post_free = reply_post_free_contig; + reply_post_free_contig += ioc->reply_post_queue_depth; + } + reply_q->reply_post_host_index = 0; - reply_q->reply_post_free = (Mpi2ReplyDescriptorsUnion_t *) - reply_post_free; for (i = 0; i < ioc->reply_post_queue_depth; i++) reply_q->reply_post_free[i].Words = cpu_to_le64(ULLONG_MAX); if (!_base_is_controller_msix_enabled(ioc)) goto skip_init_reply_post_free_queue; - /* - * If RDPQ is enabled, switch to the next allocation. - * Otherwise advance within the contiguous region. - */ - if (ioc->rdpq_array_enable) - reply_post_free = (long) - ioc->reply_post[++index].reply_post_free; - else - reply_post_free += reply_post_free_sz; } skip_init_reply_post_free_queue: