* [PATCH] mpi3mr: sanitise num_phys
@ 2024-02-26 15:10 Tomas Henzl
2024-05-07 14:48 ` Sathya Prakash Veerichetty
2024-05-11 18:39 ` Martin K. Petersen
0 siblings, 2 replies; 4+ messages in thread
From: Tomas Henzl @ 2024-02-26 15:10 UTC (permalink / raw)
To: linux-scsi; +Cc: chandrakanth.patil, sathya.prakash
Information is stored in mr_sas_port->phy_mask, values larger then size
of this field shouldn't be allowed.
Signed-off-by: Tomas Henzl <thenzl@redhat.com>
---
drivers/scsi/mpi3mr/mpi3mr_transport.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/scsi/mpi3mr/mpi3mr_transport.c b/drivers/scsi/mpi3mr/mpi3mr_transport.c
index c0c8ab586957..352f006c8fe4 100644
--- a/drivers/scsi/mpi3mr/mpi3mr_transport.c
+++ b/drivers/scsi/mpi3mr/mpi3mr_transport.c
@@ -1355,11 +1355,21 @@ static struct mpi3mr_sas_port *mpi3mr_sas_port_add(struct mpi3mr_ioc *mrioc,
mpi3mr_sas_port_sanity_check(mrioc, mr_sas_node,
mr_sas_port->remote_identify.sas_address, hba_port);
+ if (mr_sas_node->num_phys > sizeof(mr_sas_port->phy_mask) * 8)
+ ioc_info(mrioc, "max port count %u could be too high\n",
+ mr_sas_node->num_phys);
+
for (i = 0; i < mr_sas_node->num_phys; i++) {
if ((mr_sas_node->phy[i].remote_identify.sas_address !=
mr_sas_port->remote_identify.sas_address) ||
(mr_sas_node->phy[i].hba_port != hba_port))
continue;
+
+ if (i > sizeof(mr_sas_port->phy_mask) * 8) {
+ ioc_warn(mrioc, "skipping port %u, max allowed value is %lu\n",
+ i, sizeof(mr_sas_port->phy_mask) * 8);
+ goto out_fail;
+ }
list_add_tail(&mr_sas_node->phy[i].port_siblings,
&mr_sas_port->phy_list);
mr_sas_port->num_phys++;
--
2.43.2
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] mpi3mr: sanitise num_phys
2024-02-26 15:10 [PATCH] mpi3mr: sanitise num_phys Tomas Henzl
@ 2024-05-07 14:48 ` Sathya Prakash Veerichetty
2024-05-09 1:41 ` Martin K. Petersen
2024-05-11 18:39 ` Martin K. Petersen
1 sibling, 1 reply; 4+ messages in thread
From: Sathya Prakash Veerichetty @ 2024-05-07 14:48 UTC (permalink / raw)
To: Tomas Henzl; +Cc: linux-scsi, chandrakanth.patil
[-- Attachment #1: Type: text/plain, Size: 1869 bytes --]
On Mon, Feb 26, 2024 at 8:14 AM Tomas Henzl <thenzl@redhat.com> wrote:
>
> Information is stored in mr_sas_port->phy_mask, values larger then size
> of this field shouldn't be allowed.
>
> Signed-off-by: Tomas Henzl <thenzl@redhat.com>
> ---
Acked-by: Sathya Prakash Veerichetty <sathya.prakash@broadcom.com>
> drivers/scsi/mpi3mr/mpi3mr_transport.c | 10 ++++++++++
> 1 file changed, 10 insertions(+)
>
> diff --git a/drivers/scsi/mpi3mr/mpi3mr_transport.c b/drivers/scsi/mpi3mr/mpi3mr_transport.c
> index c0c8ab586957..352f006c8fe4 100644
> --- a/drivers/scsi/mpi3mr/mpi3mr_transport.c
> +++ b/drivers/scsi/mpi3mr/mpi3mr_transport.c
> @@ -1355,11 +1355,21 @@ static struct mpi3mr_sas_port *mpi3mr_sas_port_add(struct mpi3mr_ioc *mrioc,
> mpi3mr_sas_port_sanity_check(mrioc, mr_sas_node,
> mr_sas_port->remote_identify.sas_address, hba_port);
>
> + if (mr_sas_node->num_phys > sizeof(mr_sas_port->phy_mask) * 8)
> + ioc_info(mrioc, "max port count %u could be too high\n",
> + mr_sas_node->num_phys);
> +
> for (i = 0; i < mr_sas_node->num_phys; i++) {
> if ((mr_sas_node->phy[i].remote_identify.sas_address !=
> mr_sas_port->remote_identify.sas_address) ||
> (mr_sas_node->phy[i].hba_port != hba_port))
> continue;
> +
> + if (i > sizeof(mr_sas_port->phy_mask) * 8) {
> + ioc_warn(mrioc, "skipping port %u, max allowed value is %lu\n",
> + i, sizeof(mr_sas_port->phy_mask) * 8);
> + goto out_fail;
> + }
> list_add_tail(&mr_sas_node->phy[i].port_siblings,
> &mr_sas_port->phy_list);
> mr_sas_port->num_phys++;
> --
> 2.43.2
>
[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4227 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] mpi3mr: sanitise num_phys
2024-05-07 14:48 ` Sathya Prakash Veerichetty
@ 2024-05-09 1:41 ` Martin K. Petersen
0 siblings, 0 replies; 4+ messages in thread
From: Martin K. Petersen @ 2024-05-09 1:41 UTC (permalink / raw)
To: Sathya Prakash Veerichetty; +Cc: Tomas Henzl, linux-scsi, chandrakanth.patil
Sathya,
>> Information is stored in mr_sas_port->phy_mask, values larger then
>> size of this field shouldn't be allowed.
Applied to 6.10/scsi-staging, thanks!
--
Martin K. Petersen Oracle Linux Engineering
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] mpi3mr: sanitise num_phys
2024-02-26 15:10 [PATCH] mpi3mr: sanitise num_phys Tomas Henzl
2024-05-07 14:48 ` Sathya Prakash Veerichetty
@ 2024-05-11 18:39 ` Martin K. Petersen
1 sibling, 0 replies; 4+ messages in thread
From: Martin K. Petersen @ 2024-05-11 18:39 UTC (permalink / raw)
To: linux-scsi, Tomas Henzl
Cc: Martin K . Petersen, chandrakanth.patil, sathya.prakash
On Mon, 26 Feb 2024 16:10:13 +0100, Tomas Henzl wrote:
> Information is stored in mr_sas_port->phy_mask, values larger then size
> of this field shouldn't be allowed.
>
>
Applied to 6.10/scsi-queue, thanks!
[1/1] mpi3mr: sanitise num_phys
https://git.kernel.org/mkp/scsi/c/3668651def2c
--
Martin K. Petersen Oracle Linux Engineering
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2024-05-11 18:55 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-02-26 15:10 [PATCH] mpi3mr: sanitise num_phys Tomas Henzl
2024-05-07 14:48 ` Sathya Prakash Veerichetty
2024-05-09 1:41 ` Martin K. Petersen
2024-05-11 18:39 ` Martin K. Petersen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).