lkml.org 
[lkml]   [2008]   [Aug]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[patch 02/60] SCSI: ses: fix VPD inquiry overrun
2.6.26-stable review patch.  If anyone has any objections, please let us know.

------------------
From: James Bottomley <James.Bottomley@HansenPartnership.com>

commit 671a99c8eb2f1dde08ac5538d8cd912047c61ddf upstream

There are a few kerneloops.org reports like this one:

http://www.kerneloops.org/search.php?search=ses_match_to_enclosure

That seem to imply we're running off the end of the VPD inquiry data
(although at 512 bytes, it should be long enough for just about
anything). we should be using correctly sized buffers anyway, so put
those in and hope this oops goes away.

Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
drivers/scsi/ses.c | 18 ++++++++++++++----
1 file changed, 14 insertions(+), 4 deletions(-)

--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -345,14 +345,14 @@ static int ses_enclosure_find_by_addr(st
return 0;
}

-#define VPD_INQUIRY_SIZE 512
+#define VPD_INQUIRY_SIZE 36

static void ses_match_to_enclosure(struct enclosure_device *edev,
struct scsi_device *sdev)
{
unsigned char *buf = kmalloc(VPD_INQUIRY_SIZE, GFP_KERNEL);
unsigned char *desc;
- int len;
+ u16 vpd_len;
struct efd efd = {
.addr = 0,
};
@@ -372,9 +372,19 @@ static void ses_match_to_enclosure(struc
VPD_INQUIRY_SIZE, NULL, SES_TIMEOUT, SES_RETRIES))
goto free;

- len = (buf[2] << 8) + buf[3];
+ vpd_len = (buf[2] << 8) + buf[3];
+ kfree(buf);
+ buf = kmalloc(vpd_len, GFP_KERNEL);
+ if (!buf)
+ return;
+ cmd[3] = vpd_len >> 8;
+ cmd[4] = vpd_len & 0xff;
+ if (scsi_execute_req(sdev, cmd, DMA_FROM_DEVICE, buf,
+ vpd_len, NULL, SES_TIMEOUT, SES_RETRIES))
+ goto free;
+
desc = buf + 4;
- while (desc < buf + len) {
+ while (desc < buf + vpd_len) {
enum scsi_protocol proto = desc[0] >> 4;
u8 code_set = desc[0] & 0x0f;
u8 piv = desc[1] & 0x80;
--


\
 
 \ /
  Last update: 2008-08-18 20:49    [W:0.127 / U:3.528 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site