* [PATCH] lpfc: Fix bad memory access during VPD DUMP mailbox command
@ 2021-04-21 23:41 James Smart
0 siblings, 0 replies; only message in thread
From: James Smart @ 2021-04-21 23:41 UTC (permalink / raw)
To: linux-scsi; +Cc: James Smart, Justin Tee
The dump command for reading a region passes a requested read length
specified in words (4byte units). The response overwrites the same
field with the actual number of bytes read.
The mailbox handler for DUMP which reads VPD data (region 23) is
treating the response field as if it were still a word_cnt, thus
multiplying it by 4 to set the read's "length". Given the read value
was calculated based on the size of the read buffer, the longer
response length runs off the end of the buffer.
Fix by reworking the code to use the response field as a byte count.
Co-developed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Notes:
ECD submit header:
*******************
COMMIT-TITLE: Back out svn rev 73205 - causing KASAN error
COMMIT: 78630
COMMIT-BZ: 244614
COMMIT-QC:
r78630 | jinfante | 2021-04-05 12:40:48 -0700 (Mon, 05 Apr 2021) | 25 lines
Back out svn rev 73205 - causing KASAN error
Bugs: 244614
Reviewers: rkennedy pely
Symptoms:
KASAN detected issues
page dumped because: kasan: bad access detected
Cause:
svn rev 73205
Fix:
dump mbox takes word count as input, byte count as output.
Notes:
Unit Testing:
Added log message on VPD dump to verify output
System Testing:
Review_ID: https://cmengapps1.lvn.broadcom.net/r/34471/
---
drivers/scsi/lpfc/lpfc_init.c | 12 ++++++------
drivers/scsi/lpfc/lpfc_sli.c | 15 ++++++++-------
2 files changed, 14 insertions(+), 13 deletions(-)
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 1e4c792bb660..5f018d02bf56 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -254,13 +254,13 @@ lpfc_config_port_prep(struct lpfc_hba *phba)
if (mb->un.varDmp.word_cnt == 0)
break;
- i = mb->un.varDmp.word_cnt * sizeof(uint32_t);
- if (offset + i > DMP_VPD_SIZE)
- i = DMP_VPD_SIZE - offset;
+ if (mb->un.varDmp.word_cnt > DMP_VPD_SIZE - offset)
+ mb->un.varDmp.word_cnt = DMP_VPD_SIZE - offset;
lpfc_sli_pcimem_bcopy(((uint8_t *)mb) + DMP_RSP_OFFSET,
- lpfc_vpd_data + offset, i);
- offset += i;
- } while (offset < DMP_VPD_SIZE);
+ lpfc_vpd_data + offset,
+ mb->un.varDmp.word_cnt);
+ offset += mb->un.varDmp.word_cnt;
+ } while (mb->un.varDmp.word_cnt && offset < DMP_VPD_SIZE);
lpfc_parse_vpd(phba, lpfc_vpd_data, offset);
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index 579ac75dfe79..573c8599d71c 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -19777,7 +19777,7 @@ lpfc_sli_get_config_region23(struct lpfc_hba *phba, char *rgn23_data)
LPFC_MBOXQ_t *pmb = NULL;
MAILBOX_t *mb;
uint32_t offset = 0;
- int i, rc;
+ int rc;
if (!rgn23_data)
return 0;
@@ -19808,13 +19808,14 @@ lpfc_sli_get_config_region23(struct lpfc_hba *phba, char *rgn23_data)
if (mb->un.varDmp.word_cnt == 0)
break;
- i = mb->un.varDmp.word_cnt * sizeof(uint32_t);
- if (offset + i > DMP_RGN23_SIZE)
- i = DMP_RGN23_SIZE - offset;
+ if (mb->un.varDmp.word_cnt > DMP_RGN23_SIZE - offset)
+ mb->un.varDmp.word_cnt = DMP_RGN23_SIZE - offset;
+
lpfc_sli_pcimem_bcopy(((uint8_t *)mb) + DMP_RSP_OFFSET,
- rgn23_data + offset, i);
- offset += i;
- } while (offset < DMP_RGN23_SIZE);
+ rgn23_data + offset,
+ mb->un.varDmp.word_cnt);
+ offset += mb->un.varDmp.word_cnt;
+ } while (mb->un.varDmp.word_cnt && offset < DMP_RGN23_SIZE);
mempool_free(pmb, phba->mbox_mem_pool);
return offset;
--
2.26.2
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2021-04-21 23:41 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-04-21 23:41 [PATCH] lpfc: Fix bad memory access during VPD DUMP mailbox command James Smart
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.