lkml.org 
[lkml]   [2020]   [Apr]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.4 08/78] scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login
    Date
    From: James Smart <jsmart2021@gmail.com>

    [ Upstream commit 38503943c89f0bafd9e3742f63f872301d44cbea ]

    The following kasan bug was called out:

    BUG: KASAN: slab-out-of-bounds in lpfc_unreg_login+0x7c/0xc0 [lpfc]
    Read of size 2 at addr ffff889fc7c50a22 by task lpfc_worker_3/6676
    ...
    Call Trace:
    dump_stack+0x96/0xe0
    ? lpfc_unreg_login+0x7c/0xc0 [lpfc]
    print_address_description.constprop.6+0x1b/0x220
    ? lpfc_unreg_login+0x7c/0xc0 [lpfc]
    ? lpfc_unreg_login+0x7c/0xc0 [lpfc]
    __kasan_report.cold.9+0x37/0x7c
    ? lpfc_unreg_login+0x7c/0xc0 [lpfc]
    kasan_report+0xe/0x20
    lpfc_unreg_login+0x7c/0xc0 [lpfc]
    lpfc_sli_def_mbox_cmpl+0x334/0x430 [lpfc]
    ...

    When processing the completion of a "Reg Rpi" login mailbox command in
    lpfc_sli_def_mbox_cmpl, a call may be made to lpfc_unreg_login. The vpi is
    extracted from the completing mailbox context and passed as an input for
    the next. However, the vpi stored in the mailbox command context is an
    absolute vpi, which for SLI4 represents both base + offset. When used with
    a non-zero base component, (function id > 0) this results in an
    out-of-range access beyond the allocated phba->vpi_ids array.

    Fix by subtracting the function's base value to get an accurate vpi number.

    Link: https://lore.kernel.org/r/20200322181304.37655-2-jsmart2021@gmail.com
    Signed-off-by: James Smart <jsmart2021@gmail.com>
    Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/scsi/lpfc/lpfc_sli.c | 2 ++
    1 file changed, 2 insertions(+)

    diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
    index e2cec1f6e659b..8836c5682c8d5 100644
    --- a/drivers/scsi/lpfc/lpfc_sli.c
    +++ b/drivers/scsi/lpfc/lpfc_sli.c
    @@ -2480,6 +2480,8 @@ lpfc_sli_def_mbox_cmpl(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb)
    !pmb->u.mb.mbxStatus) {
    rpi = pmb->u.mb.un.varWords[0];
    vpi = pmb->u.mb.un.varRegLogin.vpi;
    + if (phba->sli_rev == LPFC_SLI_REV4)
    + vpi -= phba->sli4_hba.max_cfg_param.vpi_base;
    lpfc_unreg_login(phba, vpi, rpi, pmb);
    pmb->vport = vport;
    pmb->mbox_cmpl = lpfc_sli_def_mbox_cmpl;
    --
    2.20.1
    \
     
     \ /
      Last update: 2020-04-18 16:56    [W:4.078 / U:0.936 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site