kernel/linux.git/drivers/message/fusion/mptctl.c, branch linux-4.3.y

mptfusion: prevent some memory corruption

2015-08-26T14:11:45+00:00

These are signed values the come from the user, we put a cap on the upper bounds but not on the lower bounds. We use "karg.dataSgeOffset" to calculate "sz". We verify "sz" and proceed as if that means that "karg.dataSgeOffset" is correct but this fails to consider that the "sz" calculations can have integer overflows. Signed-off-by: Dan Carpenter Reviewed-by: Johannes Thumshirn Signed-off-by: James Bottomley

mptfusion: simplify rounding

2014-09-16T16:09:43+00:00

Rounding up to a multiple of 4 should be done using the ALIGN macro. As a bonus, this also makes the generated code smaller. In GetIocFacts(), sz is assigned to a few lines below without being read in the meantime, so it is ok that it doesn't end up with the same value as facts->FWImageSize. Signed-off-by: Rasmus Villemoes Reviewed-by: Joe Lawrence Signed-off-by: Christoph Hellwig

mptfusion: use memdup_user

2014-07-25T21:16:57+00:00

Let memdup_user handle the kmalloc, copy_from_user and error checking kfree code. Spotted by the following smatch (false positive) warning: drivers/message/fusion/mptctl.c:1369 mptctl_getiocinfo() warn: possible info leak 'karg' Signed-off-by: Joe Lawrence Acked-by: Sreekanth Reddy Signed-off-by: Christoph Hellwig

mptfusion: fix msgContext in mptctl_hp_hostinfo

2014-05-28T16:14:16+00:00

Hi, without this patch the istwiRWRequest->MsgContext is always set to zero, this patch saves the MsgContext in a msgcontext variable and then restores the value. Thanks to David Jeffery who found the issue and did the analysis. Signed-off-by: Tomas Henzl Acked-by: Desai, Kashyap Signed-off-by: Christoph Hellwig

mptctl: don't wank with fasync in ->release()

2013-04-29T19:41:44+00:00

Signed-off-by: Al Viro

drivers/message/fusion: use pci_dev->revision

2012-06-01T00:49:26+00:00

This driver uses PCI_CLASS_REVISION instead of PCI_REVISION_ID, so it wasn't converted by 44c10138fd4bbc ("PCI: Change all drivers to use pci_device->revision"). In one case, it even reads PCI revision ID without using it -- that code is now removed... Signed-off-by: Sergei Shtylyov Acked-by: "Nandigama, Nagalakshmi" Cc: Eric Moore Acked-by: Auke Kok Cc: Greg KH Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

Fix common misspellings

2011-03-31T14:26:23+00:00

Fixes generated by 'codespell' and manually reviewed. Signed-off-by: Lucas De Marchi

Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6

2011-03-18T00:54:40+00:00

* git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6: (170 commits) [SCSI] scsi_dh_rdac: Add MD36xxf into device list [SCSI] scsi_debug: add consecutive medium errors [SCSI] libsas: fix ata list corruption issue [SCSI] hpsa: export resettable host attribute [SCSI] hpsa: move device attributes to avoid forward declarations [SCSI] scsi_debug: Logical Block Provisioning (SBC3r26) [SCSI] sd: Logical Block Provisioning update [SCSI] Include protection operation in SCSI command trace [SCSI] hpsa: fix incorrect PCI IDs and add two new ones (2nd try) [SCSI] target: Fix volume size misreporting for volumes > 2TB [SCSI] bnx2fc: Broadcom FCoE offload driver [SCSI] fcoe: fix broken fcoe interface reset [SCSI] fcoe: precedence bug in fcoe_filter_frames() [SCSI] libfcoe: Remove stale fcoe-netdev entries [SCSI] libfcoe: Move FCOE_MTU definition from fcoe.h to libfcoe.h [SCSI] libfc: introduce __fc_fill_fc_hdr that accepts fc_hdr as an argument [SCSI] fcoe, libfc: initialize EM anchors list and then update npiv EMs [SCSI] Revert "[SCSI] libfc: fix exchange being deleted when the abort itself is timed out" [SCSI] libfc: Fixing a memory leak when destroying an interface [SCSI] megaraid_sas: Version and Changelog update ... Fix up trivial conflicts due to whitespace differences in drivers/scsi/libsas/{sas_ata.c,sas_scsi_host.c}

[SCSI] mptfusion: mptctl_release is required in mptctl.c

2011-02-12T18:50:48+00:00

Added missing release callback for file_operations mptctl_fops. Without release callback there will be never freed. It remains on mptctl's eent list even after the file is closed and released. Relavent RHEL bugzilla is 660871 Cc: stable@kernel.org Signed-off-by: Kashyap Desai Signed-off-by: James Bottomley

[SCSI] mptfusion: Fix memory leak in mptctl_getiocinfo()

2011-01-24T17:42:10+00:00

A 'kfree(karg)' is missing in a failure path in mptctl.c::mptctl_getiocinfo() which can cause a memory leak. Signed-off-by: Jesper Juhl Acked-by: "Desai, Kashyap" Signed-off-by: James Bottomley