Qian Cai 09d3be78ee scsi: megaraid: fix out-of-bound array accesses ... [ Upstream commit c7a082e4242fd8cd21a441071e622f87c16bdacc ] UBSAN reported those with MegaRAID SAS-3 3108, [ 77.467308] UBSAN: Undefined behaviour in drivers/scsi/megaraid/megaraid_sas_fp.c:117:32 [ 77.475402] index 255 is out of range for type 'MR_LD_SPAN_MAP [1]' [ 77.481677] CPU: 16 PID: 333 Comm: kworker/16:1 Not tainted 4.20.0-rc5+ #1 [ 77.488556] Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.50 06/01/2018 [ 77.495791] Workqueue: events work_for_cpu_fn [ 77.500154] Call trace: [ 77.502610] dump_backtrace+0x0/0x2c8 [ 77.506279] show_stack+0x24/0x30 [ 77.509604] dump_stack+0x118/0x19c [ 77.513098] ubsan_epilogue+0x14/0x60 [ 77.516765] __ubsan_handle_out_of_bounds+0xfc/0x13c [ 77.521767] mr_update_load_balance_params+0x150/0x158 [megaraid_sas] [ 77.528230] MR_ValidateMapInfo+0x2cc/0x10d0 [megaraid_sas] [ 77.533825] megasas_get_map_info+0x244/0x2f0 [megaraid_sas] [ 77.539505] megasas_init_adapter_fusion+0x9b0/0xf48 [megaraid_sas] [ 77.545794] megasas_init_fw+0x1ab4/0x3518 [megaraid_sas] [ 77.551212] megasas_probe_one+0x2c4/0xbe0 [megaraid_sas] [ 77.556614] local_pci_probe+0x7c/0xf0 [ 77.560365] work_for_cpu_fn+0x34/0x50 [ 77.564118] process_one_work+0x61c/0xf08 [ 77.568129] worker_thread+0x534/0xa70 [ 77.571882] kthread+0x1c8/0x1d0 [ 77.575114] ret_from_fork+0x10/0x1c [ 89.240332] UBSAN: Undefined behaviour in drivers/scsi/megaraid/megaraid_sas_fp.c:117:32 [ 89.248426] index 255 is out of range for type 'MR_LD_SPAN_MAP [1]' [ 89.254700] CPU: 16 PID: 95 Comm: kworker/u130:0 Not tainted 4.20.0-rc5+ #1 [ 89.261665] Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.50 06/01/2018 [ 89.268903] Workqueue: events_unbound async_run_entry_fn [ 89.274222] Call trace: [ 89.276680] dump_backtrace+0x0/0x2c8 [ 89.280348] show_stack+0x24/0x30 [ 89.283671] dump_stack+0x118/0x19c [ 89.287167] ubsan_epilogue+0x14/0x60 [ 89.290835] __ubsan_handle_out_of_bounds+0xfc/0x13c [ 89.295828] MR_LdRaidGet+0x50/0x58 [megaraid_sas] [ 89.300638] megasas_build_io_fusion+0xbb8/0xd90 [megaraid_sas] [ 89.306576] megasas_build_and_issue_cmd_fusion+0x138/0x460 [megaraid_sas] [ 89.313468] megasas_queue_command+0x398/0x3d0 [megaraid_sas] [ 89.319222] scsi_dispatch_cmd+0x1dc/0x8a8 [ 89.323321] scsi_request_fn+0x8e8/0xdd0 [ 89.327249] __blk_run_queue+0xc4/0x158 [ 89.331090] blk_execute_rq_nowait+0xf4/0x158 [ 89.335449] blk_execute_rq+0xdc/0x158 [ 89.339202] __scsi_execute+0x130/0x258 [ 89.343041] scsi_probe_and_add_lun+0x2fc/0x1488 [ 89.347661] __scsi_scan_target+0x1cc/0x8c8 [ 89.351848] scsi_scan_channel.part.3+0x8c/0xc0 [ 89.356382] scsi_scan_host_selected+0x130/0x1f0 [ 89.361002] do_scsi_scan_host+0xd8/0xf0 [ 89.364927] do_scan_async+0x9c/0x320 [ 89.368594] async_run_entry_fn+0x138/0x420 [ 89.372780] process_one_work+0x61c/0xf08 [ 89.376793] worker_thread+0x13c/0xa70 [ 89.380546] kthread+0x1c8/0x1d0 [ 89.383778] ret_from_fork+0x10/0x1c This is because when populating Driver Map using firmware raid map, all non-existing VDs set their ldTgtIdToLd to 0xff, so it can be skipped later. From drivers/scsi/megaraid/megaraid_sas_base.c , memset(instance->ld_ids, 0xff, MEGASAS_MAX_LD_IDS); From drivers/scsi/megaraid/megaraid_sas_fp.c , /* For non existing VDs, iterate to next VD*/ if (ld >= (MAX_LOGICAL_DRIVES_EXT - 1)) continue; However, there are a few places that failed to skip those non-existing VDs due to off-by-one errors. Then, those 0xff leaked into MR_LdRaidGet(0xff, map) and triggered the out-of-bound accesses. Fixes: 51087a8617 ("megaraid_sas : Extended VD support") Signed-off-by: Qian Cai <cai@lca.pw> Acked-by: Sumit Saxena <sumit.saxena@broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2019-01-26 09:42:55 +01:00
..
accessibility
acpi	ACPI: power: Skip duplicate power resource references in _PRx	2019-01-16 22:16:12 +01:00
amba	ARM: amba: Don't read past the end of sysfs "driver_override" buffer	2018-05-02 07:53:42 -07:00
android
ata	libata: whitelist all SAMSUNG MZ7KM* solid-state disks	2018-12-21 14:09:53 +01:00
atm	atm: zatm: Fix potential Spectre v1	2018-07-22 14:25:52 +02:00
auxdisplay
base	sysfs: Disable lockdep for driver bind/unbind files	2019-01-26 09:42:54 +01:00
bcma
block	loop: Fix double mutex_unlock(&loop_ctl_mutex) in loop_control_ioctl()	2019-01-26 09:42:52 +01:00
bluetooth	Revert "Bluetooth: h5: Fix missing dependency on BT_HCIUART_SERDEV"	2018-11-27 16:08:01 +01:00
bus	bus: brcmstb_gisb: correct support for 64-bit address output	2018-04-13 19:50:05 +02:00
cdrom	cdrom: fix improper type cast, which can leat to information leak.	2018-11-21 09:27:39 +01:00
char	tpm: Restore functionality to xen vtpm driver.	2018-11-21 09:27:33 +01:00
clk	clk: imx6q: reset exclusive gates on init	2019-01-26 09:42:53 +01:00
clocksource	clockevents/drivers/i8253: Add support for PIT shutdown quirk	2018-11-21 09:27:42 +01:00
connector
cpufreq	cpufreq: imx6q: add return value check for voltage scale	2018-12-01 09:46:34 +01:00
cpuidle	powerpc/pseries/cpuidle: Fix preempt warning	2019-01-26 09:42:53 +01:00
crypto	crypto: mxs-dcp - Fix wait logic on chan threads	2018-10-10 08:52:13 +02:00
dca
devfreq	PM / devfreq: tegra: fix error return code in tegra_devfreq_probe()	2018-11-10 07:41:40 -08:00
dio
dma	dmaengine: at_hdmac: fix module unloading	2018-12-13 09:21:27 +01:00
dma-buf
edac	EDAC, i7core: Fix memleaks and use-after-free on probe and remove	2018-10-10 08:52:06 +02:00
eisa
extcon
firewire	firewire-ohci: work around oversized DMA reads on JMicron controllers	2018-05-30 07:48:52 +02:00
firmware	efi/libstub/arm64: Set -fpie when building the EFI stub	2018-11-27 16:07:58 +01:00
fmc
fpga
gpio	gpio: max7301: fix driver for use with CONFIG_VMAP_STACK	2019-01-13 10:05:27 +01:00
gpu	drm/fb-helper: Ignore the value of fb_var_screeninfo.pixclock	2019-01-26 09:42:52 +01:00
hid	HID: uhid: forbid UHID_CREATE under KERNEL_DS or elevated privileges	2018-11-27 16:08:02 +01:00
hsi
hv	Drivers: hv: vmbus: Return -EINVAL for the sys files for unopened channels	2019-01-13 10:05:27 +01:00
hwmon	hwmon: (w83795) temp4_type has writable permission	2018-12-17 21:55:10 +01:00
hwspinlock
hwtracing	intel_th: msu: Fix an off-by-one in attribute store	2019-01-13 10:05:33 +01:00
i2c	i2c: dev: prevent adapter retries and timeout being set as minus value	2019-01-16 22:16:12 +01:00
ide	ide: pmac: add of_node_put()	2018-12-21 14:09:52 +01:00
idle
iio	iio: adc: at91: fix wrong channel number in triggered buffer mode	2018-11-21 09:27:35 +01:00
infiniband	mm: replace get_user_pages() write/force parameters with gup_flags	2018-12-17 21:55:16 +01:00
input	Input: omap-keypad - fix idle configuration to not block SoC idle states	2019-01-13 10:05:32 +01:00
iommu	iommu/vt-d: Handle domain agaw being less than iommu agaw	2019-01-13 10:05:33 +01:00
ipack
irqchip	irqchip/gic: Make interrupt ID 1020 invalid	2018-09-15 09:40:41 +02:00
isdn	isdn: fix kernel-infoleak in capi_unlocked_ioctl	2019-01-13 10:05:28 +01:00
leds	leds: leds-gpio: Fix return value check in create_gpio_led()	2018-12-13 09:21:31 +01:00
lguest
lightnvm
macintosh	macintosh/via-pmu: Add missing mmio accessors	2018-09-19 22:48:57 +02:00
mailbox
mcb
md	dm snapshot: Fix excessive memory usage and workqueue stalls	2019-01-26 09:42:54 +01:00
media	media: firewire: Fix app_info parameter type in avc_ca{,_app}_info	2019-01-26 09:42:53 +01:00
memory	memory: tegra: Apply interrupts mask per SoC	2018-08-06 16:24:38 +02:00
memstick
message	scsi: mptfusion: Add bounds check in mptctl_hp_targetinfo()	2018-05-30 07:48:58 +02:00
mfd	mfd: tps6586x: Handle interrupts on suspend	2019-01-26 09:42:50 +01:00
misc	genwqe: Fix size check	2019-01-13 10:05:33 +01:00
mmc	mmc: atmel-mci: do not assume idle after atmci_request_end	2019-01-26 09:42:54 +01:00
mtd	mtd: docg3: don't set conflicting BCH_CONST_PARAMS option	2018-11-21 09:27:42 +01:00
net	e1000e: allow non-monotonic SYSTIM readings	2019-01-26 09:42:52 +01:00
nfc	NFC: nfcmrvl_uart: fix OF child-node lookup	2018-12-01 09:46:35 +01:00
ntb	ntb_transport: Fix bug with max_mw_size parameter	2018-05-30 07:48:55 +02:00
nubus
nvdimm	libnvdimm: Hold reference on parent while scheduling async init	2018-11-21 09:27:34 +01:00
nvme	nvme-pci: initialize queue memory before interrupts	2018-07-11 16:03:47 +02:00
nvmem
of	of: add helper to lookup compatible child node	2018-12-01 09:46:35 +01:00
oprofile
parisc	parisc/pci: Switch LBA PCI bus from Hard Fail to Soft Fail mode	2018-05-30 07:49:10 +02:00
parport	parport: sunbpp: fix error return code	2018-09-26 08:35:09 +02:00
pci	PCI: altera: Move retrain from fixup to altera_pcie_host_init()	2019-01-16 22:16:11 +01:00
pcmcia	pcmcia: Implement CLKRUN protocol disabling for Ricoh bridges	2018-11-21 09:27:30 +01:00
perf
phy
pinctrl	pinctrl: sunxi: a83t: Fix IRQ offset typo for PH11	2018-12-21 14:09:49 +01:00
platform	platform/x86: asus-wmi: Tell the EC the OS will handle the display off hotkey	2019-01-26 09:42:52 +01:00
pnp
power	power: supply: olpc_battery: correct the temperature units	2019-01-13 10:05:34 +01:00
powercap	PowerCap: Fix an error code in powercap_register_zone()	2018-04-13 19:50:05 +02:00
pps
ps3
ptp	ptp: fix Spectre v1 vulnerability	2018-11-10 07:41:42 -08:00
pwm	pwm: tiehrpwm: Fix disabling of output of PWMs	2018-09-09 20:04:35 +02:00
rapidio
ras
regulator	regulator: pfuze100: add .is_enable() for pfuze100_swb_regulator_ops	2018-08-06 16:24:35 +02:00
remoteproc
reset
rpmsg
rtc	rtc: snvs: Add timeouts to avoid kernel lockups	2018-12-21 14:09:53 +01:00
s390	scsi: zfcp: fix posting too many status read buffers leading to adapter shutdown	2019-01-13 10:05:32 +01:00
sbus	drivers/sbus/char: add of_node_put()	2018-12-21 14:09:52 +01:00
scsi	scsi: megaraid: fix out-of-bound array accesses	2019-01-26 09:42:55 +01:00
sfi
sh
sn
soc	soc/tegra: pmc: Fix child-node lookup	2018-11-21 09:27:37 +01:00
spi	spi: bcm2835: Unbreak the build of esoteric configs	2019-01-13 10:05:31 +01:00
spmi
ssb
staging	staging: speakup: Replace strncpy with memcpy	2018-12-17 21:55:17 +01:00
target	scsi: target: use consistent left-aligned ASCII INQUIRY data	2019-01-26 09:42:53 +01:00
tc	TC: Set DMA masks for devices	2018-11-21 09:27:36 +01:00
thermal	thermal: allow u8500-thermal driver to be a module	2018-11-10 07:41:36 -08:00
thunderbolt	thunderbolt: Resume control channel after hibernation image is created	2018-04-24 09:32:07 +02:00
tty	tty/ldsem: Wake up readers after timed out down_write()	2019-01-26 09:42:45 +01:00
uio	uio: Fix an Oops on load	2018-11-27 16:08:02 +01:00
usb	USB: Add USB_QUIRK_DELAY_CTRL_MSG quirk for Corsair K70 RGB	2019-01-16 22:16:10 +01:00
uwb	uwb: hwa-rc: fix memory leak at probe	2018-10-10 08:52:04 +02:00
vfio	vfio/pci: Virtualize Maximum Read Request Size	2018-04-24 09:32:09 +02:00
vhost	vhost: make sure used idx is seen before log in vhost_add_used_n()	2019-01-13 10:05:28 +01:00
video	omap2fb: Fix stack memory disclosure	2019-01-26 09:42:50 +01:00
virt	mm: replace get_user_pages() write/force parameters with gup_flags	2018-12-17 21:55:16 +01:00
virtio	virtio_balloon: fix another race between migration and ballooning	2018-08-06 16:24:42 +02:00
vlynq
vme
w1	w1: omap-hdq: fix missing bus unregister at removal	2018-11-21 09:27:35 +01:00
watchdog	watchdog: f71808e_wdt: Fix magic close handling	2018-05-30 07:49:03 +02:00
xen	xen: xlate_mmu: add missing header to fix 'W=1' warning	2018-12-17 21:55:11 +01:00
zorro	zorro: Set up z->dev.dma_mask for the DMA API	2018-05-30 07:49:11 +02:00
Kconfig
Makefile