kernel/linux.git/drivers/message/fusion/mptctl.c, branch v4.14.78

scsi: mptfusion: Add bounds check in mptctl_hp_targetinfo()

2018-05-25T14:17:47+00:00

[ Upstream commit a7043e9529f3c367cc4d82997e00be034cbe57ca ] My static checker complains about an out of bounds read: drivers/message/fusion/mptctl.c:2786 mptctl_hp_targetinfo() error: buffer overflow 'hd->sel_timeout' 255 <= u32max. It's true that we probably should have a bounds check here. Signed-off-by: Dan Carpenter Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

Replace with globally

2016-12-24T19:46:01+00:00

This was entirely automated, using the script by Al: PATT='^[[:blank:]]*#[[:blank:]]*include[[:blank:]]*' sed -i -e "s!$PATT!#include !" \ $(git grep -l "$PATT"|grep -v ^include/linux/uaccess.h) to do the replacement at the end of the merge window. Requested-by: Al Viro Signed-off-by: Linus Torvalds

mptfusion: don't allow negative bytes in kbuf_alloc_2_sgl()

2015-11-12T01:58:06+00:00

There is a static checker warning here because "bytes" is controlled by the user and we cap the upper bound with min() but allow negatives. Negative bytes will result in some nasty warning messages but are not super harmful. Anyway, no one needs negative bytes so let's just check for it and return NULL. Signed-off-by: Dan Carpenter Signed-off-by: Martin K. Petersen

mptfusion: prevent some memory corruption

2015-08-26T14:11:45+00:00

These are signed values the come from the user, we put a cap on the upper bounds but not on the lower bounds. We use "karg.dataSgeOffset" to calculate "sz". We verify "sz" and proceed as if that means that "karg.dataSgeOffset" is correct but this fails to consider that the "sz" calculations can have integer overflows. Signed-off-by: Dan Carpenter Reviewed-by: Johannes Thumshirn Signed-off-by: James Bottomley

mptfusion: simplify rounding

2014-09-16T16:09:43+00:00

Rounding up to a multiple of 4 should be done using the ALIGN macro. As a bonus, this also makes the generated code smaller. In GetIocFacts(), sz is assigned to a few lines below without being read in the meantime, so it is ok that it doesn't end up with the same value as facts->FWImageSize. Signed-off-by: Rasmus Villemoes Reviewed-by: Joe Lawrence Signed-off-by: Christoph Hellwig

mptfusion: use memdup_user

2014-07-25T21:16:57+00:00

Let memdup_user handle the kmalloc, copy_from_user and error checking kfree code. Spotted by the following smatch (false positive) warning: drivers/message/fusion/mptctl.c:1369 mptctl_getiocinfo() warn: possible info leak 'karg' Signed-off-by: Joe Lawrence Acked-by: Sreekanth Reddy Signed-off-by: Christoph Hellwig

mptfusion: fix msgContext in mptctl_hp_hostinfo

2014-05-28T16:14:16+00:00

Hi, without this patch the istwiRWRequest->MsgContext is always set to zero, this patch saves the MsgContext in a msgcontext variable and then restores the value. Thanks to David Jeffery who found the issue and did the analysis. Signed-off-by: Tomas Henzl Acked-by: Desai, Kashyap Signed-off-by: Christoph Hellwig

mptctl: don't wank with fasync in ->release()

2013-04-29T19:41:44+00:00

Signed-off-by: Al Viro

drivers/message/fusion: use pci_dev->revision

2012-06-01T00:49:26+00:00

This driver uses PCI_CLASS_REVISION instead of PCI_REVISION_ID, so it wasn't converted by 44c10138fd4bbc ("PCI: Change all drivers to use pci_device->revision"). In one case, it even reads PCI revision ID without using it -- that code is now removed... Signed-off-by: Sergei Shtylyov Acked-by: "Nandigama, Nagalakshmi" Cc: Eric Moore Acked-by: Auke Kok Cc: Greg KH Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

Fix common misspellings

2011-03-31T14:26:23+00:00

Fixes generated by 'codespell' and manually reviewed. Signed-off-by: Lucas De Marchi