kernel/linux.git/drivers/message/fusion/mptctl.c, branch v5.4.26

scsi: mptfusion: Fix double fetch bug in ioctl

2020-01-23T07:22:35+00:00

commit 28d76df18f0ad5bcf5fa48510b225f0ed262a99b upstream. Tom Hatskevich reported that we look up "iocp" then, in the called functions we do a second copy_from_user() and look it up again. The problem that could cause is: drivers/message/fusion/mptctl.c 674 /* All of these commands require an interrupt or 675 * are unknown/illegal. 676 */ 677 if ((ret = mptctl_syscall_down(iocp, nonblock)) != 0) ^^^^ We take this lock. 678 return ret; 679 680 if (cmd == MPTFWDOWNLOAD) 681 ret = mptctl_fw_download(arg); ^^^ Then the user memory changes and we look up "iocp" again but a different one so now we are holding the incorrect lock and have a race condition. 682 else if (cmd == MPTCOMMAND) 683 ret = mptctl_mpt_command(arg); The security impact of this bug is not as bad as it could have been because these operations are all privileged and root already has enormous destructive power. But it's still worth fixing. This patch passes the "iocp" pointer to the functions to avoid the second lookup. That deletes 100 lines of code from the driver so it's a nice clean up as well. Link: https://lore.kernel.org/r/20200114123414.GA7957@kadam Reported-by: Tom Hatskevich Reviewed-by: Greg Kroah-Hartman Signed-off-by: Dan Carpenter Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman

scsi: mptfusion: fix indentation issues

2019-03-19T21:17:08+00:00

There are several statements and code blocks there are incorrectly indented. Fix these. Signed-off-by: Colin Ian King Signed-off-by: Martin K. Petersen

scsi: mptctl: change strncpy+truncation to strlcpy

2018-07-31T03:17:53+00:00

Generated by scripts/coccinelle/misc/strncpy_truncation.cocci Signed-off-by: Dominique Martinet Signed-off-by: Martin K. Petersen

scsi: mptfusion: Add bounds check in mptctl_hp_targetinfo()

2018-01-31T02:32:06+00:00

My static checker complains about an out of bounds read: drivers/message/fusion/mptctl.c:2786 mptctl_hp_targetinfo() error: buffer overflow 'hd->sel_timeout' 255 <= u32max. It's true that we probably should have a bounds check here. Signed-off-by: Dan Carpenter Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen

scsi: mptfusion: Use snprintf() instead of open coded divisions

2018-01-17T06:12:20+00:00

Numbers up to 100 snprintf() prints without using a division. Besides that the code looks more readable. Signed-off-by: Andy Shevchenko Signed-off-by: Martin K. Petersen

Replace with globally

2016-12-24T19:46:01+00:00

This was entirely automated, using the script by Al: PATT='^[[:blank:]]*#[[:blank:]]*include[[:blank:]]*' sed -i -e "s!$PATT!#include !" \ $(git grep -l "$PATT"|grep -v ^include/linux/uaccess.h) to do the replacement at the end of the merge window. Requested-by: Al Viro Signed-off-by: Linus Torvalds

mptfusion: don't allow negative bytes in kbuf_alloc_2_sgl()

2015-11-12T01:58:06+00:00

There is a static checker warning here because "bytes" is controlled by the user and we cap the upper bound with min() but allow negatives. Negative bytes will result in some nasty warning messages but are not super harmful. Anyway, no one needs negative bytes so let's just check for it and return NULL. Signed-off-by: Dan Carpenter Signed-off-by: Martin K. Petersen

mptfusion: prevent some memory corruption

2015-08-26T14:11:45+00:00

These are signed values the come from the user, we put a cap on the upper bounds but not on the lower bounds. We use "karg.dataSgeOffset" to calculate "sz". We verify "sz" and proceed as if that means that "karg.dataSgeOffset" is correct but this fails to consider that the "sz" calculations can have integer overflows. Signed-off-by: Dan Carpenter Reviewed-by: Johannes Thumshirn Signed-off-by: James Bottomley

mptfusion: simplify rounding

2014-09-16T16:09:43+00:00

Rounding up to a multiple of 4 should be done using the ALIGN macro. As a bonus, this also makes the generated code smaller. In GetIocFacts(), sz is assigned to a few lines below without being read in the meantime, so it is ok that it doesn't end up with the same value as facts->FWImageSize. Signed-off-by: Rasmus Villemoes Reviewed-by: Joe Lawrence Signed-off-by: Christoph Hellwig

mptfusion: use memdup_user

2014-07-25T21:16:57+00:00

Let memdup_user handle the kmalloc, copy_from_user and error checking kfree code. Spotted by the following smatch (false positive) warning: drivers/message/fusion/mptctl.c:1369 mptctl_getiocinfo() warn: possible info leak 'karg' Signed-off-by: Joe Lawrence Acked-by: Sreekanth Reddy Signed-off-by: Christoph Hellwig