Qian Cai 00886cebcc scsi: megaraid: fix out-of-bound array accesses ... [ Upstream commit c7a082e424 ] UBSAN reported those with MegaRAID SAS-3 3108, [ 77.467308] UBSAN: Undefined behaviour in drivers/scsi/megaraid/megaraid_sas_fp.c:117:32 [ 77.475402] index 255 is out of range for type 'MR_LD_SPAN_MAP [1]' [ 77.481677] CPU: 16 PID: 333 Comm: kworker/16:1 Not tainted 4.20.0-rc5+ #1 [ 77.488556] Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.50 06/01/2018 [ 77.495791] Workqueue: events work_for_cpu_fn [ 77.500154] Call trace: [ 77.502610] dump_backtrace+0x0/0x2c8 [ 77.506279] show_stack+0x24/0x30 [ 77.509604] dump_stack+0x118/0x19c [ 77.513098] ubsan_epilogue+0x14/0x60 [ 77.516765] __ubsan_handle_out_of_bounds+0xfc/0x13c [ 77.521767] mr_update_load_balance_params+0x150/0x158 [megaraid_sas] [ 77.528230] MR_ValidateMapInfo+0x2cc/0x10d0 [megaraid_sas] [ 77.533825] megasas_get_map_info+0x244/0x2f0 [megaraid_sas] [ 77.539505] megasas_init_adapter_fusion+0x9b0/0xf48 [megaraid_sas] [ 77.545794] megasas_init_fw+0x1ab4/0x3518 [megaraid_sas] [ 77.551212] megasas_probe_one+0x2c4/0xbe0 [megaraid_sas] [ 77.556614] local_pci_probe+0x7c/0xf0 [ 77.560365] work_for_cpu_fn+0x34/0x50 [ 77.564118] process_one_work+0x61c/0xf08 [ 77.568129] worker_thread+0x534/0xa70 [ 77.571882] kthread+0x1c8/0x1d0 [ 77.575114] ret_from_fork+0x10/0x1c [ 89.240332] UBSAN: Undefined behaviour in drivers/scsi/megaraid/megaraid_sas_fp.c:117:32 [ 89.248426] index 255 is out of range for type 'MR_LD_SPAN_MAP [1]' [ 89.254700] CPU: 16 PID: 95 Comm: kworker/u130:0 Not tainted 4.20.0-rc5+ #1 [ 89.261665] Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.50 06/01/2018 [ 89.268903] Workqueue: events_unbound async_run_entry_fn [ 89.274222] Call trace: [ 89.276680] dump_backtrace+0x0/0x2c8 [ 89.280348] show_stack+0x24/0x30 [ 89.283671] dump_stack+0x118/0x19c [ 89.287167] ubsan_epilogue+0x14/0x60 [ 89.290835] __ubsan_handle_out_of_bounds+0xfc/0x13c [ 89.295828] MR_LdRaidGet+0x50/0x58 [megaraid_sas] [ 89.300638] megasas_build_io_fusion+0xbb8/0xd90 [megaraid_sas] [ 89.306576] megasas_build_and_issue_cmd_fusion+0x138/0x460 [megaraid_sas] [ 89.313468] megasas_queue_command+0x398/0x3d0 [megaraid_sas] [ 89.319222] scsi_dispatch_cmd+0x1dc/0x8a8 [ 89.323321] scsi_request_fn+0x8e8/0xdd0 [ 89.327249] __blk_run_queue+0xc4/0x158 [ 89.331090] blk_execute_rq_nowait+0xf4/0x158 [ 89.335449] blk_execute_rq+0xdc/0x158 [ 89.339202] __scsi_execute+0x130/0x258 [ 89.343041] scsi_probe_and_add_lun+0x2fc/0x1488 [ 89.347661] __scsi_scan_target+0x1cc/0x8c8 [ 89.351848] scsi_scan_channel.part.3+0x8c/0xc0 [ 89.356382] scsi_scan_host_selected+0x130/0x1f0 [ 89.361002] do_scsi_scan_host+0xd8/0xf0 [ 89.364927] do_scan_async+0x9c/0x320 [ 89.368594] async_run_entry_fn+0x138/0x420 [ 89.372780] process_one_work+0x61c/0xf08 [ 89.376793] worker_thread+0x13c/0xa70 [ 89.380546] kthread+0x1c8/0x1d0 [ 89.383778] ret_from_fork+0x10/0x1c This is because when populating Driver Map using firmware raid map, all non-existing VDs set their ldTgtIdToLd to 0xff, so it can be skipped later. From drivers/scsi/megaraid/megaraid_sas_base.c , memset(instance->ld_ids, 0xff, MEGASAS_MAX_LD_IDS); From drivers/scsi/megaraid/megaraid_sas_fp.c , /* For non existing VDs, iterate to next VD*/ if (ld >= (MAX_LOGICAL_DRIVES_EXT - 1)) continue; However, there are a few places that failed to skip those non-existing VDs due to off-by-one errors. Then, those 0xff leaked into MR_LdRaidGet(0xff, map) and triggered the out-of-bound accesses. Fixes: 51087a8617 ("megaraid_sas : Extended VD support") Signed-off-by: Qian Cai <cai@lca.pw> Acked-by: Sumit Saxena <sumit.saxena@broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2019-01-26 09:32:43 +01:00
..
accessibility
acpi	ACPI/IORT: Fix rc_dma_get_range()	2019-01-16 22:04:34 +01:00
amba
android	binder: fix race that allows malicious free of live buffer	2018-12-05 19:32:11 +01:00
ata	libata: whitelist all SAMSUNG MZ7KM* solid-state disks	2018-12-21 14:15:20 +01:00
atm
auxdisplay	auxdisplay: charlcd: fix x/y command parsing	2019-01-13 09:51:03 +01:00
base	sysfs: Disable lockdep for driver bind/unbind files	2019-01-26 09:32:42 +01:00
bcma
block	nbd: Use set_blocksize() to set device blocksize	2019-01-22 21:40:38 +01:00
bluetooth	Bluetooth: btusb: Add support for Intel bluetooth device 8087:0029	2019-01-26 09:32:42 +01:00
bus	Merge branch 'perm-fix' into omap-for-v4.19/fixes-v2	2018-08-28 09:58:03 -07:00
cdrom	cdrom: fix improper type cast, which can leat to information leak.	2018-11-21 09:19:12 +01:00
char	tpm: tpm_i2c_nuvoton: use correct command duration for TPM 2.x	2019-01-09 17:38:49 +01:00
clk	clk: imx6q: reset exclusive gates on init	2019-01-26 09:32:38 +01:00
clocksource	clocksource/drivers/integrator-ap: Add missing of_node_put()	2019-01-26 09:32:42 +01:00
connector
cpufreq	cpufreq: scmi: Fix frequency invariance in slow path	2019-01-16 22:04:29 +01:00
cpuidle	powerpc/pseries/cpuidle: Fix preempt warning	2019-01-26 09:32:37 +01:00
crypto	crypto: talitos - fix ablkcipher for CONFIG_VMAP_STACK	2019-01-22 21:40:32 +01:00
dax	mm, devm_memremap_pages: fix shutdown handling	2019-01-13 09:51:04 +01:00
dca
devfreq	Char/Misc driver patches for 4.19-rc1	2018-08-18 11:04:51 -07:00
dio
dma	dmaengine: cppi41: delete channel from pending list when stop channel	2018-12-13 09:16:20 +01:00
dma-buf
edac	EDAC, skx_edac: Fix logical channel intermediate decoding	2018-11-13 11:08:44 -08:00
eisa
extcon
firewire	firewire: use 64-bit time_t based interfaces	2018-08-17 16:20:27 -07:00
firmware	efi/libstub: Disable some warnings for x86{,_64}	2019-01-26 09:32:36 +01:00
fmc
fpga	fpga: altera-cvp: fix probing for multiple FPGAs on the bus	2019-01-26 09:32:36 +01:00
fsi	fsi: master-ast-cf: select GENERIC_ALLOCATOR	2018-12-17 09:24:35 +01:00
gnss	gnss: sirf: fix activation retry handling	2018-12-13 09:16:22 +01:00
gpio	gpio: pl061: Move irq_chip definition inside struct pl061	2019-01-26 09:32:33 +01:00
gpu	drm/amdgpu: Reorder uvd ring init before uvd resume	2019-01-26 09:32:36 +01:00
hid	HID: ite: Add USB id match for another ITE based keyboard rfkill key quirk	2019-01-13 09:50:56 +01:00
hsi
hv	x86, hyperv: remove PCI dependency	2019-01-13 09:51:00 +01:00
hwmon	hwmon: (w83795) temp4_type has writable permission	2018-12-17 09:24:33 +01:00
hwspinlock	hwspinlock: Fix incorrect return pointers	2018-07-30 20:54:51 -07:00
hwtracing	intel_th: msu: Fix an off-by-one in attribute store	2019-01-13 09:51:10 +01:00
i2c	i2c: dev: prevent adapter retries and timeout being set as minus value	2019-01-16 22:04:34 +01:00
ide	ide: pmac: add of_node_put()	2018-12-21 14:15:18 +01:00
idle
iio	iio: dac: ad5686: fix bit shift read register	2019-01-13 09:51:08 +01:00
infiniband	IB/usnic: Fix potential deadlock	2019-01-26 09:32:42 +01:00
input	Input: synaptics - enable SMBus for HP EliteBook 840 G4	2019-01-13 09:51:03 +01:00
iommu	iommu/vt-d: Handle domain agaw being less than iommu agaw	2019-01-13 09:51:09 +01:00
ipack
irqchip	irqchip/pdc: Setup all edge interrupts as rising edge at GIC	2018-11-13 11:08:34 -08:00
isdn	isdn: fix kernel-infoleak in capi_unlocked_ioctl	2019-01-09 17:38:31 +01:00
leds	leds: pwm: silently error out on EPROBE_DEFER	2019-01-13 09:51:08 +01:00
lightnvm	lightnvm: pblk: fix race condition on metadata I/O	2018-11-13 11:08:21 -08:00
macintosh	macintosh: therm_windtunnel: drop using attach_adapter	2018-08-24 14:42:42 +02:00
mailbox	mailbox: PCC: handle parse error	2018-11-13 11:08:18 -08:00
mcb
md	dm: Check for device sector overflow if CONFIG_LBDAF is not set	2019-01-26 09:32:42 +01:00
media	media: venus: core: Set dma maximum segment size	2019-01-26 09:32:38 +01:00
memory	memory: ti-aemif: fix a potential NULL-pointer dereference	2018-09-06 10:04:07 -07:00
memstick
message	scsi: message: fusion: Replace GFP_ATOMIC with GFP_KERNEL	2018-07-30 23:17:53 -04:00
mfd	mfd: tps6586x: Handle interrupts on suspend	2019-01-22 21:40:33 +01:00
misc	genwqe: Fix size check	2019-01-13 09:51:10 +01:00
mmc	mmc: atmel-mci: do not assume idle after atmci_request_end	2019-01-26 09:32:39 +01:00
mtd	mtd: rawnand: qcom: fix memory corruption that causes panic	2019-01-16 22:04:34 +01:00
mux	mux: adgs1408: use the correct MODULE_LICENSE	2018-10-12 17:36:39 +02:00
net	ath10k: fix peer stats null pointer dereference	2019-01-26 09:32:43 +01:00
nfc	NFC: nfcmrvl_uart: fix OF child-node lookup	2018-11-13 11:08:48 -08:00
ntb
nubus
nvdimm	mm, devm_memremap_pages: fix shutdown handling	2019-01-13 09:51:04 +01:00
nvme	nvmet-rdma: fix response use after free	2018-12-21 14:15:25 +01:00
nvmem	nvmem: check the return value of nvmem_add_cells()	2018-11-13 11:08:35 -08:00
of	of: overlay: add missing of_node_put() after add new node to changeset	2019-01-26 09:32:34 +01:00
opp	opp: ti-opp-supply: Correct the supply in _get_optimal_vdd_voltage call	2018-12-01 09:37:27 +01:00
oprofile
parisc
parport	Char/Misc driver patches for 4.19-rc1	2018-08-18 11:04:51 -07:00
pci	PCI: dwc: Move interrupt acking into the proper callback	2019-01-16 22:04:35 +01:00
pcmcia	pcmcia: Implement CLKRUN protocol disabling for Ricoh bridges	2018-11-13 11:08:17 -08:00
perf	drivers/perf: hisi: Fixup one DDRC PMU register offset	2019-01-13 09:51:10 +01:00
phy	phy: qcom-qusb2: Fix HSTX_TRIM tuning with fused value for SDM845	2018-12-17 09:24:34 +01:00
pinctrl	pinctrl: meson: fix pull enable register calculation	2019-01-13 09:50:54 +01:00
platform	platform/x86: asus-wmi: Tell the EC the OS will handle the display off hotkey	2019-01-26 09:32:34 +01:00
pnp
power	power: supply: olpc_battery: correct the temperature units	2019-01-13 09:51:10 +01:00
powercap
pps
ps3
ptp	ptp: fix Spectre v1 vulnerability	2018-10-17 22:00:22 -07:00
pwm	pwm: mediatek: Add MT7628 support	2018-08-20 11:36:07 +02:00
rapidio	drivers/rapidio/devices/rio_mport_cdev.c: remove redundant pointer md	2018-08-22 10:52:51 -07:00
ras
regulator	regulator: fix crash caused by null driver data	2018-09-20 09:04:51 -07:00
remoteproc	remoteproc: qcom: q6v5: Propagate EPROBE_DEFER	2018-11-13 11:08:52 -08:00
reset	ARM: SoC: late updates	2018-08-25 14:12:36 -07:00
rpmsg	rpmsg: smd: fix memory leak on channel create	2018-11-13 11:08:55 -08:00
rtc	rtc: m41t80: Correct alarm month range with RTC reads	2019-01-09 17:38:48 +01:00
s390	scsi: zfcp: fix posting too many status read buffers leading to adapter shutdown	2019-01-13 09:51:03 +01:00
sbus	drivers/sbus/char: add of_node_put()	2018-12-21 14:15:17 +01:00
scsi	scsi: megaraid: fix out-of-bound array accesses	2019-01-26 09:32:43 +01:00
sfi
sh	sh: introduce a sh_cacheop_vaddr helper	2018-08-02 13:54:06 +02:00
siox
slimbus	slimbus: ngd: mark PM functions as __maybe_unused	2018-12-19 19:19:49 +01:00
sn
soc	soc: ti: QMSS: Fix usage of irq_set_affinity_hint	2018-11-21 09:19:18 +01:00
soundwire	soundwire: Fix acquiring bus lock twice during master release	2018-08-27 09:49:48 +05:30
spi	spi: bcm2835: Unbreak the build of esoteric configs	2019-01-09 17:38:49 +01:00
spmi
ssb	ssb: Remove SSB_WARN_ON, SSB_BUG_ON and SSB_DEBUG	2018-08-09 18:47:47 +03:00
staging	staging: erofs: fix use-after-free of on-stack `z_erofs_vle_unzip_io'	2019-01-26 09:32:38 +01:00
target	scsi: target/core: Make sure that target_wait_for_sess_cmds() waits long enough	2019-01-26 09:32:38 +01:00
tc	TC: Set DMA masks for devices	2018-11-13 11:08:51 -08:00
tee	ARM: SoC driver updates	2018-08-23 13:52:46 -07:00
thermal	thermal: armada: fix legacy validity test sense	2018-12-21 14:15:22 +01:00
thunderbolt	thunderbolt: Prevent root port runtime suspend during NVM upgrade	2018-12-17 09:24:36 +01:00
tty	tty/serial: do not free trasnmit buffer page under port lock	2019-01-26 09:32:40 +01:00
uio	uio: Fix an Oops on load	2018-11-27 16:13:09 +01:00
usb	usb: gadget: udc: renesas_usb3: add a safety connection way for forced_b_device	2019-01-26 09:32:36 +01:00
uwb
vfio	vfio/type1: Fix unmap overflow off-by-one	2019-01-16 22:04:34 +01:00
vhost	vhost: make sure used idx is seen before log in vhost_add_used_n()	2019-01-09 17:38:34 +01:00
video	omap2fb: Fix stack memory disclosure	2019-01-22 21:40:34 +01:00
virt
virtio	virtio, vhost: fixes, tweaks	2018-08-24 08:45:19 -07:00
visorbus
vlynq
vme
w1	w1: omap-hdq: fix missing bus unregister at removal	2018-11-13 11:08:48 -08:00
watchdog	include/linux/compiler*.h: make compiler-*.h mutually exclusive	2018-08-22 17:31:34 -07:00
xen	xen: Fix x86 sched_clock() interface for xen	2019-01-22 21:40:32 +01:00
zorro
Kconfig
Makefile	Char/Misc driver patches for 4.19-rc1	2018-08-18 11:04:51 -07:00