From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.5 required=3.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5621EC07E99 for ; Thu, 8 Jul 2021 07:47:00 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 3190161C91 for ; Thu, 8 Jul 2021 07:47:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230491AbhGHHtk (ORCPT ); Thu, 8 Jul 2021 03:49:40 -0400 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:28710 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229851AbhGHHti (ORCPT ); Thu, 8 Jul 2021 03:49:38 -0400 Received: from pps.filterd (m0246631.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.0.43/8.16.0.43) with SMTP id 1687kiOL005579; Thu, 8 Jul 2021 07:46:54 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : mime-version : content-transfer-encoding; s=corp-2020-01-29; bh=c8iN/XWCuVrPGPxQXlhQ1efb/+eXkhGD1kjrilkU3eE=; b=NYvbx7xhH3p/ovJk7fDW1NvmzNgHwe6nU5jLfKUh5oUanLfkZZjD0QLN2cZELvvXWHon gbRlxqoZ8KPIwQ00eXG9AbijkLwYprPGXJ5wngs+G5FbDKDA5BjEniNhEQzIQrwJ+RtV WYCAfa5+oxqIrt8AnhS6uoFHiJRmUIsfh16IBwuIn2uyU0a8U/OolQ9y5EULYfB6fK31 rML7bmuwtWGCMP+PhTkutHUF5u8wJNGvEdgUHgzGr374pdu4liJuY++sSX4W+sNz6TXt 4LhF714pecrC2scNYneHaVrTtKsNvGkFFX+DvNP3s8vWSpaB6stJXV3CR8vIBpiWIzUQ 9g== Received: from userp3030.oracle.com (userp3030.oracle.com [156.151.31.80]) by mx0b-00069f02.pphosted.com with ESMTP id 39npwbrfws-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 08 Jul 2021 07:46:54 +0000 Received: from pps.filterd (userp3030.oracle.com [127.0.0.1]) by userp3030.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 1687kCOC066489; Thu, 8 Jul 2021 07:46:53 GMT Received: from pps.reinject (localhost [127.0.0.1]) by userp3030.oracle.com with ESMTP id 39jd1502ek-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 08 Jul 2021 07:46:53 +0000 Received: from userp3030.oracle.com (userp3030.oracle.com [127.0.0.1]) by pps.reinject (8.16.0.36/8.16.0.36) with SMTP id 1687kB6E066348; Thu, 8 Jul 2021 07:46:52 GMT Received: from manjaro.in.oracle.com (dhcp-10-191-197-186.vpn.oracle.com [10.191.197.186]) by userp3030.oracle.com with ESMTP id 39jd1502bg-1; Thu, 08 Jul 2021 07:46:52 +0000 From: Harshvardhan Jha To: kashyap.desai@broadcom.com Cc: sumit.saxena@broadcom.com, shivasharan.srikanteshwara@broadcom.com, jejb@linux.ibm.com, martin.petersen@oracle.com, megaraidlinux.pdl@broadcom.com, linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org, dan.carpenter@oracle.com, Harshvardhan Jha Subject: [PATCH] scsi: megaraid_mm: Fix end of loop tests for list_for_each_entry Date: Thu, 8 Jul 2021 13:16:42 +0530 Message-Id: <20210708074642.23599-1-harshvardhan.jha@oracle.com> X-Mailer: git-send-email 2.32.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Proofpoint-GUID: coJ31HP0X3f8TOM6dViEqz-tTIkzH06T X-Proofpoint-ORIG-GUID: coJ31HP0X3f8TOM6dViEqz-tTIkzH06T Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The list_for_each_entry() iterator, "adapter" in this code, can never be NULL. If we exit the loop without finding the correct adapter then "adapter" points invalid memory that is an offset from the list head. This will eventually lead to memory corruption and presumably a kernel crash. Signed-off-by: Harshvardhan Jha --- >From static analysis. Not tested. --- drivers/scsi/megaraid/megaraid_mm.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/drivers/scsi/megaraid/megaraid_mm.c b/drivers/scsi/megaraid/megaraid_mm.c index abf7b401f5b9..c509440bd161 100644 --- a/drivers/scsi/megaraid/megaraid_mm.c +++ b/drivers/scsi/megaraid/megaraid_mm.c @@ -238,7 +238,7 @@ mraid_mm_get_adapter(mimd_t __user *umimd, int *rval) mimd_t mimd; uint32_t adapno; int iterator; - + bool is_found; if (copy_from_user(&mimd, umimd, sizeof(mimd_t))) { *rval = -EFAULT; @@ -254,12 +254,16 @@ mraid_mm_get_adapter(mimd_t __user *umimd, int *rval) adapter = NULL; iterator = 0; + is_found = false; list_for_each_entry(adapter, &adapters_list_g, list) { - if (iterator++ == adapno) break; + if (iterator++ == adapno) { + is_found = true; + break; + } } - if (!adapter) { + if (!is_found) { *rval = -ENODEV; return NULL; } @@ -725,6 +729,7 @@ ioctl_done(uioc_t *kioc) uint32_t adapno; int iterator; mraid_mmadp_t* adapter; + bool is_found; /* * When the kioc returns from driver, make sure it still doesn't @@ -747,19 +752,23 @@ ioctl_done(uioc_t *kioc) iterator = 0; adapter = NULL; adapno = kioc->adapno; + is_found = false; con_log(CL_ANN, ( KERN_WARNING "megaraid cmm: completed " "ioctl that was timedout before\n")); list_for_each_entry(adapter, &adapters_list_g, list) { - if (iterator++ == adapno) break; + if (iterator++ == adapno) { + is_found = true; + break; + } } kioc->timedout = 0; - if (adapter) { + if (is_found) mraid_mm_dealloc_kioc( adapter, kioc ); - } + } else { wake_up(&wait_q); -- 2.32.0