All of lore.kernel.org
 help / color / mirror / Atom feed
From: Don Brace <don.brace@microchip.com>
To: <Kevin.Barnett@microchip.com>, <scott.teel@microchip.com>,
	<Justin.Lindley@microchip.com>, <scott.benesh@microchip.com>,
	<gerry.morong@microchip.com>, <mahesh.rajashekhara@microchip.com>,
	<mike.mcgowen@microchip.com>, <murthy.bhat@microchip.com>,
	<hch@infradead.org>, <jejb@linux.vnet.ibm.com>,
	<joseph.szczypek@hpe.com>, <POSWALD@suse.com>
Cc: <linux-scsi@vger.kernel.org>
Subject: [PATCH 1/2] smartpqi: fix blocks_per_row static checker issue
Date: Thu, 15 Apr 2021 11:42:04 -0500	[thread overview]
Message-ID: <161850492435.7302.392780350442938047.stgit@brunhilda> (raw)
In-Reply-To: <161850488487.7302.7018870513204678832.stgit@brunhilda>

Dan Carpenter found a possible divide by 0 issue in the smartpqi driver
in functions pci_get_aio_common_raid_map_values and
pqi_calc_aio_r5_or_r6.  The variable rmd->blocks_per_row is
used as a divisor and could be 0.

Link: https://lore.kernel.org/linux-scsi/YG%2F5kWHHAr7w5dU5@mwanda/
Fixes: 6702d2c40f31 ("scsi: smartpqi: Add support for RAID5 and RAID6 writes")
       Using rmd->blocks_per_row as a divisor without checking
       it for 0 first.

Correct these possible divide by 0 conditions by insuring that
rmd->blocks_per_row is not zero before usage.
The check for non-0 was too late to prevent a divide by 0 condition.
Add in a comment to explain why the check for non-zero
is necessary. If the member is 0, return PQI_RAID_BYPASS_INELIGIBLE
before any division is performed.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Reported-by: kernel test robot <lkp@intel.com>
Reviewed-by: Scott Benesh <scott.benesh@microchip.com>
Reviewed-by: Scott Teel <scott.teel@microchip.com>
Reviewed-by: Mike McGowen <mike.mcgowen@microchip.com>
Reviewed-by: Kevin Barnett <kevin.barnett@microchip.com>
Signed-off-by: Don Brace <don.brace@microchip.com>
---
 drivers/scsi/smartpqi/smartpqi_init.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
index 3b0f281daa2b..797ac699b7ff 100644
--- a/drivers/scsi/smartpqi/smartpqi_init.c
+++ b/drivers/scsi/smartpqi/smartpqi_init.c
@@ -2510,6 +2510,8 @@ static int pci_get_aio_common_raid_map_values(struct pqi_ctrl_info *ctrl_info,
 
 	/* Calculate stripe information for the request. */
 	rmd->blocks_per_row = rmd->data_disks_per_row * rmd->strip_size;
+	if (rmd->blocks_per_row == 0) /* Used as a divisor in many calculations */
+		return PQI_RAID_BYPASS_INELIGIBLE;
 #if BITS_PER_LONG == 32
 	tmpdiv = rmd->first_block;
 	do_div(tmpdiv, rmd->blocks_per_row);
@@ -2559,6 +2561,10 @@ static int pqi_calc_aio_r5_or_r6(struct pqi_scsi_dev_raid_map_data *rmd,
 #if BITS_PER_LONG == 32
 	u64 tmpdiv;
 #endif
+
+	if (rmd->blocks_per_row == 0) /* Used as a divisor in many calculations */
+		return PQI_RAID_BYPASS_INELIGIBLE;
+
 	/* RAID 50/60 */
 	/* Verify first and last block are in same RAID group. */
 	rmd->stripesize = rmd->blocks_per_row * rmd->layout_map_count;
@@ -2662,8 +2668,6 @@ static int pqi_calc_aio_r5_or_r6(struct pqi_scsi_dev_raid_map_data *rmd,
 			rmd->q_parity_it_nexus = raid_map->disk_data[index + 1].aio_handle;
 			rmd->xor_mult = raid_map->disk_data[rmd->map_index].xor_mult[1];
 		}
-		if (rmd->blocks_per_row == 0)
-			return PQI_RAID_BYPASS_INELIGIBLE;
 #if BITS_PER_LONG == 32
 		tmpdiv = rmd->first_block;
 		do_div(tmpdiv, rmd->blocks_per_row);


  reply	other threads:[~2021-04-15 16:42 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-04-15 16:41 [PATCH 0/2] smartpqi fix static checker issues Don Brace
2021-04-15 16:42 ` Don Brace [this message]
2021-04-15 16:42 ` [PATCH 2/2] smartpqi: fix device pointer variable reference static checker issue Don Brace
2021-04-16  2:03 ` [PATCH 0/2] smartpqi fix static checker issues Martin K. Petersen
2021-04-20  2:29 ` Martin K. Petersen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=161850492435.7302.392780350442938047.stgit@brunhilda \
    --to=don.brace@microchip.com \
    --cc=Justin.Lindley@microchip.com \
    --cc=Kevin.Barnett@microchip.com \
    --cc=POSWALD@suse.com \
    --cc=gerry.morong@microchip.com \
    --cc=hch@infradead.org \
    --cc=jejb@linux.vnet.ibm.com \
    --cc=joseph.szczypek@hpe.com \
    --cc=linux-scsi@vger.kernel.org \
    --cc=mahesh.rajashekhara@microchip.com \
    --cc=mike.mcgowen@microchip.com \
    --cc=murthy.bhat@microchip.com \
    --cc=scott.benesh@microchip.com \
    --cc=scott.teel@microchip.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.