[PATCH] mpt3sas: fix an out of bound write

[PATCH] mpt3sas: fix an out of bound write

[Tomas Henzl]

cpu_msix_table is allocated to store online cpus, but pci_irq_get_affinity
may return cpu_possible_mask which is then used to access cpu_msix_table.
That causes bad user experience.
Fix limits access to only online cpus, I've also added an additonal test
to protect from an unlikely change in cpu_online_mask.

Fixes: 1d55abc0e98a0bf35f3af80665aac564e3b30572 scsi: mpt3sas: switch to pci_alloc_irq_vectors

Signed-off-by: Tomas Henzl <thenzl@redhat.com>
---
 drivers/scsi/mpt3sas/mpt3sas_base.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
index 13d6e4ec3..59a87ca32 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
@@ -2410,8 +2410,11 @@ _base_assign_reply_queues(struct MPT3SAS_ADAPTER *ioc)
 				continue;
 			}
 
-			for_each_cpu(cpu, mask)
+			for_each_cpu_and(cpu, mask, cpu_online_mask) {
+				if (cpu >= ioc->cpu_msix_table_sz)
+					break;
 				ioc->cpu_msix_table[cpu] = reply_q->msix_index;
+			}
 		}
 		return;
 	}
-- 
2.14.3

Re: [PATCH] mpt3sas: fix an out of bound write

[Suganath Prabu Subramani]

Hi,
Please consider this patch as Ack-by: Suganath Prabu S
<suganath-prabu.subramani@broadcom.com>

Thanks.

On Fri, Jan 19, 2018 at 8:52 PM, Tomas Henzl <thenzl@redhat.com> wrote:
> cpu_msix_table is allocated to store online cpus, but pci_irq_get_affinity
> may return cpu_possible_mask which is then used to access cpu_msix_table.
> That causes bad user experience.
> Fix limits access to only online cpus, I've also added an additonal test
> to protect from an unlikely change in cpu_online_mask.
>
> Fixes: 1d55abc0e98a0bf35f3af80665aac564e3b30572 scsi: mpt3sas: switch to pci_alloc_irq_vectors
>
> Signed-off-by: Tomas Henzl <thenzl@redhat.com>
> ---
>  drivers/scsi/mpt3sas/mpt3sas_base.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
> index 13d6e4ec3..59a87ca32 100644
> --- a/drivers/scsi/mpt3sas/mpt3sas_base.c
> +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
> @@ -2410,8 +2410,11 @@ _base_assign_reply_queues(struct MPT3SAS_ADAPTER *ioc)
>                                 continue;
>                         }
>
> -                       for_each_cpu(cpu, mask)
> +                       for_each_cpu_and(cpu, mask, cpu_online_mask) {
> +                               if (cpu >= ioc->cpu_msix_table_sz)
> +                                       break;
>                                 ioc->cpu_msix_table[cpu] = reply_q->msix_index;
> +                       }
>                 }
>                 return;
>         }
> --
> 2.14.3
>

Re: [PATCH] mpt3sas: fix an out of bound write

[Martin K. Petersen]

Tomas,

> cpu_msix_table is allocated to store online cpus, but
> pci_irq_get_affinity may return cpu_possible_mask which is then used
> to access cpu_msix_table. That causes bad user experience.  Fix
> limits access to only online cpus, I've also added an additonal test
> to protect from an unlikely change in cpu_online_mask.

Applied to 4.16/scsi-fixes. Thanks!

-- 
Martin K. Petersen	Oracle Linux Engineering