From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Qian Cai <cai@lca.pw>,
"Martin K . Petersen" <martin.petersen@oracle.com>,
Sasha Levin <sashal@kernel.org>,
megaraidlinux.pdl@broadcom.com, linux-scsi@vger.kernel.org
Subject: [PATCH AUTOSEL 4.14 49/53] scsi: megaraid: fix out-of-bound array accesses
Date: Tue, 8 Jan 2019 14:32:17 -0500 [thread overview]
Message-ID: <20190108193222.123316-49-sashal@kernel.org> (raw)
In-Reply-To: <20190108193222.123316-1-sashal@kernel.org>
From: Qian Cai <cai@lca.pw>
[ Upstream commit c7a082e4242fd8cd21a441071e622f87c16bdacc ]
UBSAN reported those with MegaRAID SAS-3 3108,
[ 77.467308] UBSAN: Undefined behaviour in drivers/scsi/megaraid/megaraid_sas_fp.c:117:32
[ 77.475402] index 255 is out of range for type 'MR_LD_SPAN_MAP [1]'
[ 77.481677] CPU: 16 PID: 333 Comm: kworker/16:1 Not tainted 4.20.0-rc5+ #1
[ 77.488556] Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.50 06/01/2018
[ 77.495791] Workqueue: events work_for_cpu_fn
[ 77.500154] Call trace:
[ 77.502610] dump_backtrace+0x0/0x2c8
[ 77.506279] show_stack+0x24/0x30
[ 77.509604] dump_stack+0x118/0x19c
[ 77.513098] ubsan_epilogue+0x14/0x60
[ 77.516765] __ubsan_handle_out_of_bounds+0xfc/0x13c
[ 77.521767] mr_update_load_balance_params+0x150/0x158 [megaraid_sas]
[ 77.528230] MR_ValidateMapInfo+0x2cc/0x10d0 [megaraid_sas]
[ 77.533825] megasas_get_map_info+0x244/0x2f0 [megaraid_sas]
[ 77.539505] megasas_init_adapter_fusion+0x9b0/0xf48 [megaraid_sas]
[ 77.545794] megasas_init_fw+0x1ab4/0x3518 [megaraid_sas]
[ 77.551212] megasas_probe_one+0x2c4/0xbe0 [megaraid_sas]
[ 77.556614] local_pci_probe+0x7c/0xf0
[ 77.560365] work_for_cpu_fn+0x34/0x50
[ 77.564118] process_one_work+0x61c/0xf08
[ 77.568129] worker_thread+0x534/0xa70
[ 77.571882] kthread+0x1c8/0x1d0
[ 77.575114] ret_from_fork+0x10/0x1c
[ 89.240332] UBSAN: Undefined behaviour in drivers/scsi/megaraid/megaraid_sas_fp.c:117:32
[ 89.248426] index 255 is out of range for type 'MR_LD_SPAN_MAP [1]'
[ 89.254700] CPU: 16 PID: 95 Comm: kworker/u130:0 Not tainted 4.20.0-rc5+ #1
[ 89.261665] Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.50 06/01/2018
[ 89.268903] Workqueue: events_unbound async_run_entry_fn
[ 89.274222] Call trace:
[ 89.276680] dump_backtrace+0x0/0x2c8
[ 89.280348] show_stack+0x24/0x30
[ 89.283671] dump_stack+0x118/0x19c
[ 89.287167] ubsan_epilogue+0x14/0x60
[ 89.290835] __ubsan_handle_out_of_bounds+0xfc/0x13c
[ 89.295828] MR_LdRaidGet+0x50/0x58 [megaraid_sas]
[ 89.300638] megasas_build_io_fusion+0xbb8/0xd90 [megaraid_sas]
[ 89.306576] megasas_build_and_issue_cmd_fusion+0x138/0x460 [megaraid_sas]
[ 89.313468] megasas_queue_command+0x398/0x3d0 [megaraid_sas]
[ 89.319222] scsi_dispatch_cmd+0x1dc/0x8a8
[ 89.323321] scsi_request_fn+0x8e8/0xdd0
[ 89.327249] __blk_run_queue+0xc4/0x158
[ 89.331090] blk_execute_rq_nowait+0xf4/0x158
[ 89.335449] blk_execute_rq+0xdc/0x158
[ 89.339202] __scsi_execute+0x130/0x258
[ 89.343041] scsi_probe_and_add_lun+0x2fc/0x1488
[ 89.347661] __scsi_scan_target+0x1cc/0x8c8
[ 89.351848] scsi_scan_channel.part.3+0x8c/0xc0
[ 89.356382] scsi_scan_host_selected+0x130/0x1f0
[ 89.361002] do_scsi_scan_host+0xd8/0xf0
[ 89.364927] do_scan_async+0x9c/0x320
[ 89.368594] async_run_entry_fn+0x138/0x420
[ 89.372780] process_one_work+0x61c/0xf08
[ 89.376793] worker_thread+0x13c/0xa70
[ 89.380546] kthread+0x1c8/0x1d0
[ 89.383778] ret_from_fork+0x10/0x1c
This is because when populating Driver Map using firmware raid map, all
non-existing VDs set their ldTgtIdToLd to 0xff, so it can be skipped later.
From drivers/scsi/megaraid/megaraid_sas_base.c ,
memset(instance->ld_ids, 0xff, MEGASAS_MAX_LD_IDS);
From drivers/scsi/megaraid/megaraid_sas_fp.c ,
/* For non existing VDs, iterate to next VD*/
if (ld >= (MAX_LOGICAL_DRIVES_EXT - 1))
continue;
However, there are a few places that failed to skip those non-existing VDs
due to off-by-one errors. Then, those 0xff leaked into MR_LdRaidGet(0xff,
map) and triggered the out-of-bound accesses.
Fixes: 51087a8617fe ("megaraid_sas : Extended VD support")
Signed-off-by: Qian Cai <cai@lca.pw>
Acked-by: Sumit Saxena <sumit.saxena@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/megaraid/megaraid_sas_fp.c | 2 +-
drivers/scsi/megaraid/megaraid_sas_fusion.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/scsi/megaraid/megaraid_sas_fp.c b/drivers/scsi/megaraid/megaraid_sas_fp.c
index f2ffde430ec1..9a2a62e39e4c 100644
--- a/drivers/scsi/megaraid/megaraid_sas_fp.c
+++ b/drivers/scsi/megaraid/megaraid_sas_fp.c
@@ -1266,7 +1266,7 @@ void mr_update_load_balance_params(struct MR_DRV_RAID_MAP_ALL *drv_map,
for (ldCount = 0; ldCount < MAX_LOGICAL_DRIVES_EXT; ldCount++) {
ld = MR_TargetIdToLdGet(ldCount, drv_map);
- if (ld >= MAX_LOGICAL_DRIVES_EXT) {
+ if (ld >= MAX_LOGICAL_DRIVES_EXT - 1) {
lbInfo[ldCount].loadBalanceFlag = 0;
continue;
}
diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
index 06a2e3d9fc5b..7be2b9e11332 100644
--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
@@ -2529,7 +2529,7 @@ static void megasas_build_ld_nonrw_fusion(struct megasas_instance *instance,
device_id < instance->fw_supported_vd_count)) {
ld = MR_TargetIdToLdGet(device_id, local_map_ptr);
- if (ld >= instance->fw_supported_vd_count)
+ if (ld >= instance->fw_supported_vd_count - 1)
fp_possible = 0;
else {
raid = MR_LdRaidGet(ld, local_map_ptr);
--
2.19.1
next prev parent reply other threads:[~2019-01-08 19:44 UTC|newest]
Thread overview: 53+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-01-08 19:31 [PATCH AUTOSEL 4.14 01/53] gpio: pl061: Move irq_chip definition inside struct pl061 Sasha Levin
2019-01-08 19:31 ` [PATCH AUTOSEL 4.14 02/53] platform/x86: asus-wmi: Tell the EC the OS will handle the display off hotkey Sasha Levin
2019-01-08 19:31 ` [PATCH AUTOSEL 4.14 03/53] e1000e: allow non-monotonic SYSTIM readings Sasha Levin
2019-01-08 19:31 ` [PATCH AUTOSEL 4.14 04/53] writeback: don't decrement wb->refcnt if !wb->bdi Sasha Levin
2019-01-08 19:31 ` [PATCH AUTOSEL 4.14 05/53] serial: set suppress_bind_attrs flag only if builtin Sasha Levin
2019-01-08 19:31 ` [PATCH AUTOSEL 4.14 06/53] ALSA: oxfw: add support for APOGEE duet FireWire Sasha Levin
2019-01-08 19:31 ` [PATCH AUTOSEL 4.14 07/53] x86/mce: Fix -Wmissing-prototypes warnings Sasha Levin
2019-01-08 19:31 ` [PATCH AUTOSEL 4.14 08/53] MIPS: SiByte: Enable swiotlb for SWARM, LittleSur and BigSur Sasha Levin
2019-01-08 19:31 ` [PATCH AUTOSEL 4.14 09/53] arm64: perf: set suppress_bind_attrs flag to true Sasha Levin
2019-01-08 19:31 ` [PATCH AUTOSEL 4.14 10/53] USB: serial: ftdi_sio: use rounding when calculating baud rate divisors Sasha Levin
2019-01-08 19:31 ` [PATCH AUTOSEL 4.14 11/53] usb: gadget: udc: renesas_usb3: add a safety connection way for forced_b_device Sasha Levin
2019-01-08 19:31 ` [PATCH AUTOSEL 4.14 12/53] selinux: always allow mounting submounts Sasha Levin
2019-01-08 19:31 ` [PATCH AUTOSEL 4.14 13/53] drm/amdgpu: Correct get_crtc_scanoutpos behavior when vpos >= vtotal Sasha Levin
2019-01-08 19:31 ` [PATCH AUTOSEL 4.14 14/53] rxe: IB_WR_REG_MR does not capture MR's iova field Sasha Levin
2019-01-08 19:31 ` [PATCH AUTOSEL 4.14 15/53] jffs2: Fix use of uninitialized delayed_work, lockdep breakage Sasha Levin
2019-01-08 19:31 ` [PATCH AUTOSEL 4.14 16/53] clk: imx: make mux parent strings const Sasha Levin
2019-01-08 19:31 ` [PATCH AUTOSEL 4.14 17/53] pstore/ram: Do not treat empty buffers as valid Sasha Levin
2019-01-08 19:31 ` [PATCH AUTOSEL 4.14 18/53] powerpc/xmon: Fix invocation inside lock region Sasha Levin
2019-01-08 19:31 ` [PATCH AUTOSEL 4.14 19/53] powerpc/pseries/cpuidle: Fix preempt warning Sasha Levin
2019-01-08 19:31 ` [PATCH AUTOSEL 4.14 20/53] arm64: relocatable: fix inconsistencies in linker script and options Sasha Levin
2019-01-08 19:31 ` [PATCH AUTOSEL 4.14 21/53] media: firewire: Fix app_info parameter type in avc_ca{,_app}_info Sasha Levin
2019-01-08 19:31 ` [PATCH AUTOSEL 4.14 22/53] IB/hfi1: Incorrect sizing of sge for PIO will OOPs Sasha Levin
2019-01-08 19:31 ` [PATCH AUTOSEL 4.14 23/53] media: venus: core: Set dma maximum segment size Sasha Levin
2019-01-08 19:31 ` [PATCH AUTOSEL 4.14 24/53] net: call sk_dst_reset when set SO_DONTROUTE Sasha Levin
2019-01-08 19:31 ` [PATCH AUTOSEL 4.14 25/53] scsi: target: use consistent left-aligned ASCII INQUIRY data Sasha Levin
2019-01-08 19:31 ` [PATCH AUTOSEL 4.14 26/53] selftests: do not macro-expand failed assertion expressions Sasha Levin
2019-01-08 19:31 ` [PATCH AUTOSEL 4.14 27/53] clk: imx6q: reset exclusive gates on init Sasha Levin
2019-01-08 19:31 ` [PATCH AUTOSEL 4.14 28/53] arm64: Fix minor issues with the dcache_by_line_op macro Sasha Levin
2019-01-08 19:31 ` [PATCH AUTOSEL 4.14 29/53] kconfig: fix file name and line number of warn_ignored_character() Sasha Levin
2019-01-08 19:31 ` [PATCH AUTOSEL 4.14 30/53] kconfig: fix memory leak when EOF is encountered in quotation Sasha Levin
2019-01-08 19:31 ` [PATCH AUTOSEL 4.14 31/53] mmc: atmel-mci: do not assume idle after atmci_request_end Sasha Levin
2019-01-08 19:32 ` [PATCH AUTOSEL 4.14 32/53] btrfs: improve error handling of btrfs_add_link Sasha Levin
2019-01-08 19:32 ` [PATCH AUTOSEL 4.14 33/53] tty/serial: do not free trasnmit buffer page under port lock Sasha Levin
2019-01-08 19:32 ` [PATCH AUTOSEL 4.14 34/53] perf intel-pt: Fix error with config term "pt=0" Sasha Levin
2019-01-08 19:32 ` [PATCH AUTOSEL 4.14 35/53] perf svghelper: Fix unchecked usage of strncpy() Sasha Levin
2019-01-08 19:32 ` [PATCH AUTOSEL 4.14 36/53] perf parse-events: " Sasha Levin
2019-01-08 19:32 ` [PATCH AUTOSEL 4.14 37/53] netfilter: ipt_CLUSTERIP: check MAC address when duplicate config is set Sasha Levin
2019-01-08 19:32 ` [PATCH AUTOSEL 4.14 38/53] dm crypt: use u64 instead of sector_t to store iv_offset Sasha Levin
2019-01-08 19:32 ` [PATCH AUTOSEL 4.14 39/53] dm kcopyd: Fix bug causing workqueue stalls Sasha Levin
2019-01-08 19:32 ` [PATCH AUTOSEL 4.14 40/53] tools lib subcmd: Don't add the kernel sources to the include path Sasha Levin
2019-01-08 19:32 ` [PATCH AUTOSEL 4.14 41/53] dm snapshot: Fix excessive memory usage and workqueue stalls Sasha Levin
2019-01-08 19:32 ` [PATCH AUTOSEL 4.14 42/53] quota: Lock s_umount in exclusive mode for Q_XQUOTA{ON,OFF} quotactls Sasha Levin
2019-01-08 19:32 ` [PATCH AUTOSEL 4.14 43/53] clocksource/drivers/integrator-ap: Add missing of_node_put() Sasha Levin
2019-01-08 19:32 ` [PATCH AUTOSEL 4.14 44/53] ALSA: bebob: fix model-id of unit for Apogee Ensemble Sasha Levin
2019-01-08 19:32 ` [PATCH AUTOSEL 4.14 45/53] sysfs: Disable lockdep for driver bind/unbind files Sasha Levin
2019-01-08 19:32 ` [PATCH AUTOSEL 4.14 46/53] IB/usnic: Fix potential deadlock Sasha Levin
2019-01-08 19:32 ` [PATCH AUTOSEL 4.14 47/53] scsi: smartpqi: correct lun reset issues Sasha Levin
2019-01-08 19:32 ` [PATCH AUTOSEL 4.14 48/53] scsi: smartpqi: call pqi_free_interrupts() in pqi_shutdown() Sasha Levin
2019-01-08 19:32 ` Sasha Levin [this message]
2019-01-08 19:32 ` [PATCH AUTOSEL 4.14 50/53] ocfs2: fix panic due to unrecovered local alloc Sasha Levin
2019-01-08 19:32 ` [PATCH AUTOSEL 4.14 51/53] mm/page-writeback.c: don't break integrity writeback on ->writepage() error Sasha Levin
2019-01-08 19:32 ` [PATCH AUTOSEL 4.14 52/53] mm/swap: use nr_node_ids for avail_lists in swap_info_struct Sasha Levin
2019-01-08 19:32 ` [PATCH AUTOSEL 4.14 53/53] mm, proc: be more verbose about unstable VMA flags in /proc/<pid>/smaps Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190108193222.123316-49-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=cai@lca.pw \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=martin.petersen@oracle.com \
--cc=megaraidlinux.pdl@broadcom.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome