Qian Cai
c010d4948a
scsi: megaraid: fix out-of-bound array accesses
[ Upstream commit c7a082e424 ]
UBSAN reported those with MegaRAID SAS-3 3108,
[ 77.467308] UBSAN: Undefined behaviour in drivers/scsi/megaraid/megaraid_sas_fp.c:117:32
[ 77.475402] index 255 is out of range for type 'MR_LD_SPAN_MAP [1]'
[ 77.481677] CPU: 16 PID: 333 Comm: kworker/16:1 Not tainted 4.20.0-rc5+ #1
[ 77.488556] Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.50 06/01/2018
[ 77.495791] Workqueue: events work_for_cpu_fn
[ 77.500154] Call trace:
[ 77.502610] dump_backtrace+0x0/0x2c8
[ 77.506279] show_stack+0x24/0x30
[ 77.509604] dump_stack+0x118/0x19c
[ 77.513098] ubsan_epilogue+0x14/0x60
[ 77.516765] __ubsan_handle_out_of_bounds+0xfc/0x13c
[ 77.521767] mr_update_load_balance_params+0x150/0x158 [megaraid_sas]
[ 77.528230] MR_ValidateMapInfo+0x2cc/0x10d0 [megaraid_sas]
[ 77.533825] megasas_get_map_info+0x244/0x2f0 [megaraid_sas]
[ 77.539505] megasas_init_adapter_fusion+0x9b0/0xf48 [megaraid_sas]
[ 77.545794] megasas_init_fw+0x1ab4/0x3518 [megaraid_sas]
[ 77.551212] megasas_probe_one+0x2c4/0xbe0 [megaraid_sas]
[ 77.556614] local_pci_probe+0x7c/0xf0
[ 77.560365] work_for_cpu_fn+0x34/0x50
[ 77.564118] process_one_work+0x61c/0xf08
[ 77.568129] worker_thread+0x534/0xa70
[ 77.571882] kthread+0x1c8/0x1d0
[ 77.575114] ret_from_fork+0x10/0x1c
[ 89.240332] UBSAN: Undefined behaviour in drivers/scsi/megaraid/megaraid_sas_fp.c:117:32
[ 89.248426] index 255 is out of range for type 'MR_LD_SPAN_MAP [1]'
[ 89.254700] CPU: 16 PID: 95 Comm: kworker/u130:0 Not tainted 4.20.0-rc5+ #1
[ 89.261665] Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.50 06/01/2018
[ 89.268903] Workqueue: events_unbound async_run_entry_fn
[ 89.274222] Call trace:
[ 89.276680] dump_backtrace+0x0/0x2c8
[ 89.280348] show_stack+0x24/0x30
[ 89.283671] dump_stack+0x118/0x19c
[ 89.287167] ubsan_epilogue+0x14/0x60
[ 89.290835] __ubsan_handle_out_of_bounds+0xfc/0x13c
[ 89.295828] MR_LdRaidGet+0x50/0x58 [megaraid_sas]
[ 89.300638] megasas_build_io_fusion+0xbb8/0xd90 [megaraid_sas]
[ 89.306576] megasas_build_and_issue_cmd_fusion+0x138/0x460 [megaraid_sas]
[ 89.313468] megasas_queue_command+0x398/0x3d0 [megaraid_sas]
[ 89.319222] scsi_dispatch_cmd+0x1dc/0x8a8
[ 89.323321] scsi_request_fn+0x8e8/0xdd0
[ 89.327249] __blk_run_queue+0xc4/0x158
[ 89.331090] blk_execute_rq_nowait+0xf4/0x158
[ 89.335449] blk_execute_rq+0xdc/0x158
[ 89.339202] __scsi_execute+0x130/0x258
[ 89.343041] scsi_probe_and_add_lun+0x2fc/0x1488
[ 89.347661] __scsi_scan_target+0x1cc/0x8c8
[ 89.351848] scsi_scan_channel.part.3+0x8c/0xc0
[ 89.356382] scsi_scan_host_selected+0x130/0x1f0
[ 89.361002] do_scsi_scan_host+0xd8/0xf0
[ 89.364927] do_scan_async+0x9c/0x320
[ 89.368594] async_run_entry_fn+0x138/0x420
[ 89.372780] process_one_work+0x61c/0xf08
[ 89.376793] worker_thread+0x13c/0xa70
[ 89.380546] kthread+0x1c8/0x1d0
[ 89.383778] ret_from_fork+0x10/0x1c
This is because when populating Driver Map using firmware raid map, all
non-existing VDs set their ldTgtIdToLd to 0xff, so it can be skipped later.
From drivers/scsi/megaraid/megaraid_sas_base.c ,
memset(instance->ld_ids, 0xff, MEGASAS_MAX_LD_IDS);
From drivers/scsi/megaraid/megaraid_sas_fp.c ,
/* For non existing VDs, iterate to next VD*/
if (ld >= (MAX_LOGICAL_DRIVES_EXT - 1))
continue;
However, there are a few places that failed to skip those non-existing VDs
due to off-by-one errors. Then, those 0xff leaked into MR_LdRaidGet(0xff,
map) and triggered the out-of-bound accesses.
Fixes: 51087a8617 ("megaraid_sas : Extended VD support")
Signed-off-by: Qian Cai <cai@lca.pw>
Acked-by: Sumit Saxena <sumit.saxena@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-01-26 09:37:06 +01:00
..
2018-11-04 14:52:42 +01:00
2017-11-02 11:10:55 +01:00
2018-09-15 09:45:30 +02:00
2017-08-10 19:40:50 -04:00
2018-04-26 11:02:10 +02:00
2017-08-07 14:04:01 -04:00
2018-12-08 13:03:35 +01:00
2019-01-13 10:00:57 +01:00
2018-10-03 17:00:52 -07:00
2018-10-10 08:54:19 +02:00
2017-12-25 14:26:25 +01:00
2018-08-03 07:50:41 +02:00
2017-06-26 12:44:35 -04:00
2017-06-20 12:18:27 +02:00
2017-08-24 22:28:52 -04:00
2018-09-05 09:26:32 +02:00
2017-11-02 11:10:55 +01:00
2018-08-03 07:50:36 +02:00
2018-11-04 14:52:45 +01:00
2018-10-20 09:48:50 +02:00
2018-06-21 04:02:46 +09:00
2018-09-26 08:38:13 +02:00
2018-05-25 16:17:34 +02:00
2019-01-13 10:01:01 +01:00
2019-01-26 09:37:06 +01:00
2018-09-05 09:26:41 +02:00
2018-05-25 16:17:50 +02:00
2018-01-02 20:31:05 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2018-08-24 13:09:15 +02:00
2018-10-10 08:54:23 +02:00
2018-11-21 09:24:08 +01:00
2018-05-25 16:17:48 +02:00
2019-01-26 09:37:06 +01:00
2017-11-02 11:10:55 +01:00
2018-05-25 16:17:47 +02:00
2018-08-03 07:50:32 +02:00
2018-09-19 22:43:42 +02:00
2018-09-19 22:43:42 +02:00
2018-09-19 22:43:42 +02:00
2017-08-25 17:21:11 -04:00
2017-11-02 11:10:55 +01:00
2017-08-25 17:21:10 -04:00
2017-11-02 11:10:55 +01:00
2017-08-25 17:21:10 -04:00
2017-11-02 11:10:55 +01:00
2017-04-04 19:39:39 -04:00
2017-08-25 17:21:11 -04:00
2017-11-02 11:10:55 +01:00
2017-08-24 22:29:07 -04:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-08-25 17:21:11 -04:00
2017-11-02 11:10:55 +01:00
2017-04-21 10:31:33 -04:00
2017-04-21 10:31:33 -04:00
2017-08-24 22:29:06 -04:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-08-25 17:21:11 -04:00
2017-08-10 19:55:35 -04:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-08-25 17:21:12 -04:00
2018-11-13 11:14:56 -08:00
2018-11-13 11:14:56 -08:00
2017-08-25 17:21:10 -04:00
2017-08-25 17:21:10 -04:00
2017-08-25 17:21:11 -04:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-08-07 14:04:01 -04:00
2017-11-02 11:10:55 +01:00
2017-08-25 17:21:10 -04:00
2017-11-02 11:10:55 +01:00
2018-08-15 18:12:47 +02:00
2017-06-12 20:48:00 -04:00
2018-08-15 18:12:47 +02:00
2018-08-15 18:12:47 +02:00
2017-08-25 17:21:10 -04:00
2017-08-25 17:21:11 -04:00
2017-11-02 11:10:55 +01:00
2018-10-20 09:48:51 +02:00
2018-10-20 09:48:51 +02:00
2017-06-20 12:18:27 +02:00
2017-06-20 12:18:27 +02:00
2018-05-25 16:17:49 +02:00
2017-09-13 10:47:14 -07:00
2017-08-22 16:34:36 +02:00
2018-12-21 14:13:11 +01:00
2017-08-07 14:04:02 -04:00
2017-11-02 11:10:55 +01:00
2018-11-13 11:14:56 -08:00
2017-08-25 17:21:11 -04:00
2017-11-02 11:10:55 +01:00
2018-08-03 07:50:36 +02:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-04-24 18:16:49 -04:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-09-01 11:59:17 +02:00
2017-11-02 11:10:55 +01:00
2017-08-25 17:21:11 -04:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-08-24 22:29:01 -04:00
2017-11-02 11:10:55 +01:00
2017-08-24 22:29:05 -04:00
2017-08-07 14:04:01 -04:00
2017-08-25 17:21:11 -04:00
2017-11-02 11:10:55 +01:00
2017-05-16 08:44:21 -03:00
2017-08-25 17:21:11 -04:00
2017-11-02 11:10:55 +01:00
2017-08-25 17:21:11 -04:00
2017-08-28 22:15:46 -04:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-12-20 10:10:28 +01:00
2017-12-20 10:10:20 +01:00
2017-04-26 15:09:04 -06:00
2018-12-08 13:03:38 +01:00
2018-08-03 07:50:40 +02:00
2018-03-15 10:54:29 +01:00
2017-08-25 17:08:07 -04:00
2017-11-02 11:10:55 +01:00
2018-11-21 09:24:09 +01:00
2017-11-02 11:10:55 +01:00
2017-04-13 13:58:20 -04:00
2019-01-23 08:09:48 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2018-09-05 09:26:41 +02:00
2017-11-02 11:10:55 +01:00
2017-10-11 14:33:12 -04:00
2018-06-21 04:02:43 +09:00
2017-08-29 21:51:45 -04:00
2018-06-05 11:41:59 +02:00
2017-09-07 12:12:43 -07:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2018-07-25 11:25:06 +02:00
2019-01-23 08:09:48 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2018-03-19 08:42:51 +01:00
2018-08-06 16:20:52 +02:00
2017-08-25 17:21:10 -04:00
2017-03-15 19:27:46 -04:00
2018-05-30 07:51:49 +02:00
2017-11-02 11:10:55 +01:00
2018-08-15 18:12:47 +02:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-08-08 11:49:51 -04:00
2017-11-02 11:10:55 +01:00
2017-04-26 18:32:29 -04:00
2018-06-21 04:02:46 +09:00
2017-08-25 17:21:11 -04:00
2017-06-27 21:46:55 -04:00
2018-08-15 18:12:47 +02:00
2018-12-21 14:13:12 +01:00
2017-08-25 17:21:10 -04:00
2017-11-02 11:10:55 +01:00
2018-08-24 13:09:01 +02:00
2017-08-22 16:34:36 +02:00