Skip to content

Commit b284879

Browse files
torvaldstorvalds
committed
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull SCSI fixes from James Bottomley: "Six fairly small fixes. The ipr, mpt3sas and ses ones all trigger oopses. The megaraid one fixes an attach failure on io mapped only cards, the fcoe one is an obvious problem in the error path and the aacraid one is a theoretical security issue (ability to trick the kernel into a buffer overrun)" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: ses: Fix racy cleanup of /sys in remove_dev() mpt3sas: Fix resume on WarpDrive flash cards ipr: Fix sync scsi scan megaraid_sas: Fix probing cards without io port aacraid: Check size values after double-fetch from user fcoe: Use kfree_skb() instead of kfree()
2 parents 080ebb1 + 01b3add commit b284879

File tree

6 files changed

+29
-19
lines changed

6 files changed

+29
-19
lines changed

‎drivers/scsi/aacraid/commctrl.c

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg)
6363
struct fib *fibptr;
6464
struct hw_fib * hw_fib = (struct hw_fib *)0;
6565
dma_addr_t hw_fib_pa = (dma_addr_t)0LL;
66-
unsigned size;
66+
unsigned int size, osize;
6767
int retval;
6868

6969
if (dev->in_reset) {
@@ -87,7 +87,8 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg)
8787
* will not overrun the buffer when we copy the memory. Return
8888
* an error if we would.
8989
*/
90-
size = le16_to_cpu(kfib->header.Size) + sizeof(struct aac_fibhdr);
90+
osize = size = le16_to_cpu(kfib->header.Size) +
91+
sizeof(struct aac_fibhdr);
9192
if (size < le16_to_cpu(kfib->header.SenderSize))
9293
size = le16_to_cpu(kfib->header.SenderSize);
9394
if (size > dev->max_fib_size) {
@@ -118,6 +119,14 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg)
118119
goto cleanup;
119120
}
120121

122+
/* Sanity check the second copy */
123+
if ((osize != le16_to_cpu(kfib->header.Size) +
124+
sizeof(struct aac_fibhdr))
125+
|| (size < le16_to_cpu(kfib->header.SenderSize))) {
126+
retval = -EINVAL;
127+
goto cleanup;
128+
}
129+
121130
if (kfib->header.Command == cpu_to_le16(TakeABreakPt)) {
122131
aac_adapter_interrupt(dev);
123132
/*

‎drivers/scsi/fcoe/fcoe_ctlr.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2923,7 +2923,7 @@ static int fcoe_ctlr_vlan_recv(struct fcoe_ctlr *fip, struct sk_buff *skb)
29232923
mutex_unlock(&fip->ctlr_mutex);
29242924

29252925
drop:
2926-
kfree(skb);
2926+
kfree_skb(skb);
29272927
return rc;
29282928
}
29292929

‎drivers/scsi/megaraid/megaraid_sas_base.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5037,7 +5037,7 @@ static int megasas_init_fw(struct megasas_instance *instance)
50375037
/* Find first memory bar */
50385038
bar_list = pci_select_bars(instance->pdev, IORESOURCE_MEM);
50395039
instance->bar = find_first_bit(&bar_list, sizeof(unsigned long));
5040-
if (pci_request_selected_regions(instance->pdev, instance->bar,
5040+
if (pci_request_selected_regions(instance->pdev, 1<<instance->bar,
50415041
"megasas: LSI")) {
50425042
dev_printk(KERN_DEBUG, &instance->pdev->dev, "IO memory region busy!\n");
50435043
return -EBUSY;
@@ -5339,7 +5339,7 @@ static int megasas_init_fw(struct megasas_instance *instance)
53395339
iounmap(instance->reg_set);
53405340

53415341
fail_ioremap:
5342-
pci_release_selected_regions(instance->pdev, instance->bar);
5342+
pci_release_selected_regions(instance->pdev, 1<<instance->bar);
53435343

53445344
return -EINVAL;
53455345
}
@@ -5360,7 +5360,7 @@ static void megasas_release_mfi(struct megasas_instance *instance)
53605360

53615361
iounmap(instance->reg_set);
53625362

5363-
pci_release_selected_regions(instance->pdev, instance->bar);
5363+
pci_release_selected_regions(instance->pdev, 1<<instance->bar);
53645364
}
53655365

53665366
/**

‎drivers/scsi/megaraid/megaraid_sas_fusion.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2603,7 +2603,7 @@ megasas_release_fusion(struct megasas_instance *instance)
26032603

26042604
iounmap(instance->reg_set);
26052605

2606-
pci_release_selected_regions(instance->pdev, instance->bar);
2606+
pci_release_selected_regions(instance->pdev, 1<<instance->bar);
26072607
}
26082608

26092609
/**

‎drivers/scsi/mpt3sas/mpt3sas_base.c

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -2188,6 +2188,17 @@ mpt3sas_base_map_resources(struct MPT3SAS_ADAPTER *ioc)
21882188
} else
21892189
ioc->msix96_vector = 0;
21902190

2191+
if (ioc->is_warpdrive) {
2192+
ioc->reply_post_host_index[0] = (resource_size_t __iomem *)
2193+
&ioc->chip->ReplyPostHostIndex;
2194+
2195+
for (i = 1; i < ioc->cpu_msix_table_sz; i++)
2196+
ioc->reply_post_host_index[i] =
2197+
(resource_size_t __iomem *)
2198+
((u8 __iomem *)&ioc->chip->Doorbell + (0x4000 + ((i - 1)
2199+
* 4)));
2200+
}
2201+
21912202
list_for_each_entry(reply_q, &ioc->reply_queue_list, list)
21922203
pr_info(MPT3SAS_FMT "%s: IRQ %d\n",
21932204
reply_q->name, ((ioc->msix_enable) ? "PCI-MSI-X enabled" :
@@ -5280,17 +5291,6 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPTER *ioc)
52805291
if (r)
52815292
goto out_free_resources;
52825293

5283-
if (ioc->is_warpdrive) {
5284-
ioc->reply_post_host_index[0] = (resource_size_t __iomem *)
5285-
&ioc->chip->ReplyPostHostIndex;
5286-
5287-
for (i = 1; i < ioc->cpu_msix_table_sz; i++)
5288-
ioc->reply_post_host_index[i] =
5289-
(resource_size_t __iomem *)
5290-
((u8 __iomem *)&ioc->chip->Doorbell + (0x4000 + ((i - 1)
5291-
* 4)));
5292-
}
5293-
52945294
pci_set_drvdata(ioc->pdev, ioc->shost);
52955295
r = _base_get_ioc_facts(ioc, CAN_SLEEP);
52965296
if (r)

‎drivers/scsi/ses.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -778,6 +778,8 @@ static void ses_intf_remove_enclosure(struct scsi_device *sdev)
778778
if (!edev)
779779
return;
780780

781+
enclosure_unregister(edev);
782+
781783
ses_dev = edev->scratch;
782784
edev->scratch = NULL;
783785

@@ -789,7 +791,6 @@ static void ses_intf_remove_enclosure(struct scsi_device *sdev)
789791
kfree(edev->component[0].scratch);
790792

791793
put_device(&edev->edev);
792-
enclosure_unregister(edev);
793794
}
794795

795796
static void ses_intf_remove(struct device *cdev,

0 commit comments

Comments
 (0)