Skip to contentSkip to conversation

megaraid_sas: harmless memory corruption in megasas_mgmt_fw_ioctl()

PATCH In review Dan Carpenter 2 participants 2 messages Feb 25, 2015

Subsystems (3)
SCSI Kernel janitors Megaraid SCSI/SAS drivers
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 megaraid_sas: harmless memory corruption in megasas_mgmt_fw_ioctl()

The intent here was for the "kbuff_arr[i] = NULL;" to be inside the loop but, because the curly braces were missing, it's after the loop. This means we corrupt a little memory one step beyond the array. Fortunately, we weren't going to use that memory anyway so it's harmless. Also we aren't going to use kbuff_arr[] again so we don't need to set it to NULL.

I have deleted that line of code.

Signed-off-by Dan Carpenter <[email protected]>
drivers/scsi/megaraid/megaraid_sas_base.c +0 -1
index 890637f..834bfc0 100644
@@ -6208,7 +6208,6 @@ megasas_mgmt_fw_ioctl(struct megasas_instance *instance,
 					  le32_to_cpu(kern_sge32[i].length),
 					  kbuff_arr[i],
 					  le32_to_cpu(kern_sge32[i].phys_addr));
-			kbuff_arr[i] = NULL;
 	}
 
 	if (instance->ctrl_context && cmd->mpt_pthr_cmd_blocked)
Acked-by on v1 1/1
#1 lore raw
Quoted 11 lines

-----Original Message-----
From: Dan Carpenter [mailto:[email protected]]
Sent: Wednesday, February 25, 2015 6:53 PM
To: Kashyap Desai
Cc: Sumit Saxena; Uday Lingala; James E.J. Bottomley; [email protected]; [email protected]; kernel- [email protected]
Subject: [patch] megaraid_sas: harmless memory corruption in megasas_mgmt_fw_ioctl()

The intent here was for the "kbuff_arr[i] = NULL;" to be inside the loop

but,

Quoted 4 lines

because the curly braces were missing, it's after the loop. This means we corrupt a little memory one step beyond the array. Fortunately, we weren't going to use that memory anyway so it's harmless. Also we aren't going to use kbuff_arr[] again so we don't need to set it

to

Quoted 12 lines

NULL.

I have deleted that line of code.

Signed-off-by Dan Carpenter <[email protected]>
drivers/scsi/megaraid/megaraid_sas_base.c +0 -0
index 890637f..834bfc0 100644

drivers/scsi/megaraid/megaraid_sas_base.c megasas_mgmt_fw_ioctl(struct megasas_instance · line 6209

Quoted 2 lines
drivers/scsi/megaraid/megaraid_sas_base.c +0 -0
@@ -6208,7 +6208,6 @@ megasas_mgmt_fw_ioctl(struct megasas_instance
 *instance,

le32_to_cpu(kern_sge32[i].length),

Quoted 7 lines
drivers/scsi/megaraid/megaraid_sas_base.c +0 -1
 					  kbuff_arr[i],
 
 le32_to_cpu(kern_sge32[i].phys_addr));
-			kbuff_arr[i] = NULL;
 	}

	if (instance->ctrl_context && cmd->mpt_pthr_cmd_blocked)
Acked-by Sumit Saxena <[email protected]>

-Sumit