ses: fix additional element traversal bug
James Bottomley
maintainerPATCH 1/1 ses: fix additional element traversal bug
KASAN found that our additional element processing scripts drop off the end of the VPD page into unallocated space. The reason is that not every element has additional information but our traversal routines think they do, leading to them expecting far more additional information than is present. Fix this by adding a gate to the traversal routine so that it only processes elements that are expected to have additional information (list is in SES-2 section 6.1.13.1:
Additional Element Status diagnostic page overview)
---
drivers/scsi/ses.c +9 -1
@@ -561,7 +561,15 @@ static void ses_enclosure_data_process(struct enclosure_device *edev,if (desc_ptr) desc_ptr += len; -if (addl_desc_ptr) +if (addl_desc_ptr && +/* only find additional descriptions for specific devices */ + (type_ptr[0 ] ==ENCLOSURE_COMPONENT_DEVICE || + type_ptr[0 ] ==ENCLOSURE_COMPONENT_ARRAY_DEVICE || + type_ptr[0 ] ==ENCLOSURE_COMPONENT_SAS_EXPANDER || +/* these elements are optional */ + type_ptr[0 ] ==ENCLOSURE_COMPONENT_SCSI_TARGET_PORT || + type_ptr[0 ] ==ENCLOSURE_COMPONENT_SCSI_INITIATOR_PORT || + type_ptr[0 ] ==ENCLOSURE_COMPONENT_CONTROLLER_ELECTRONICS )) addl_desc_ptr += addl_desc_ptr[1 ] +2 ; }
include/linux/enclosure.h +4 -0
@@ -29,7 +29,11 @@/* A few generic types ... taken from ses-2 */ enum enclosure_component_type {ENCLOSURE_COMPONENT_DEVICE =0x01 , +ENCLOSURE_COMPONENT_CONTROLLER_ELECTRONICS =0x07 , +ENCLOSURE_COMPONENT_SCSI_TARGET_PORT =0x14 , +ENCLOSURE_COMPONENT_SCSI_INITIATOR_PORT =0x15 ,ENCLOSURE_COMPONENT_ARRAY_DEVICE =0x17 , +ENCLOSURE_COMPONENT_SAS_EXPANDER =0x18 , };/* ses-2 common element status */
Quoted 44 lines · James Bottomley
KASAN found that our additional element processing scripts drop off the end of the VPD page into unallocated space. The reason is that not every element has additional information but our traversal routines think they do, leading to them expecting far more additional information than is present. Fix this by adding a gate to the traversal routine so that it only processes elements that are expected to have additional information (list is in SES-2 section 6.1.13.1:
Additional Element Status diagnostic page overview)Reported-by Pavel Tikhomirov <[email protected]>Tested-by Pavel Tikhomirov <[email protected]>Signed-off-by James Bottomley <[email protected]>---
drivers/scsi/ses.c +9
-1@@ -561,7 +561,15 @@ static void ses_enclosure_data_process(struct enclosure_device *edev,if (desc_ptr) desc_ptr += len; -if (addl_desc_ptr) +if (addl_desc_ptr && +/* only find additional descriptions for specific devices */ + (type_ptr[0 ] ==ENCLOSURE_COMPONENT_DEVICE || + type_ptr[0 ] ==ENCLOSURE_COMPONENT_ARRAY_DEVICE || + type_ptr[0 ] ==ENCLOSURE_COMPONENT_SAS_EXPANDER || +/* these elements are optional */ + type_ptr[0 ] ==ENCLOSURE_COMPONENT_SCSI_TARGET_PORT || + type_ptr[0 ] ==ENCLOSURE_COMPONENT_SCSI_INITIATOR_PORT || + type_ptr[0 ] ==ENCLOSURE_COMPONENT_CONTROLLER_ELECTRONICS )) addl_desc_ptr += addl_desc_ptr[1 ] +2 ; }include/linux/enclosure.h +0
-0@@ -29,7 +29,11 @@/* A few generic types ... taken from ses-2 */
include/linux/enclosure.h line 39
Quoted 10 lines
include/linux/enclosure.h +4
-0enum enclosure_component_type {ENCLOSURE_COMPONENT_DEVICE =0x01 , +ENCLOSURE_COMPONENT_CONTROLLER_ELECTRONICS =0x07 , +ENCLOSURE_COMPONENT_SCSI_TARGET_PORT =0x14 , +ENCLOSURE_COMPONENT_SCSI_INITIATOR_PORT =0x15 ,ENCLOSURE_COMPONENT_ARRAY_DEVICE =0x17 , +ENCLOSURE_COMPONENT_SAS_EXPANDER =0x18 , };/* ses-2 common element status */
Cheers,
Hannes
Signature · 9 lines
Dr. Hannes Reinecke zSeries & Storage [email protected] +49 911 74053 688 SUSE LINUX GmbH, Maxfeldstr. 5, 90409 Nürnberg GF: F. Imendörffer, J. Smithard, J. Guild, D. Upmanyu, G. Norton HRB 21284 (AG Nürnberg) -- To unsubscribe from this list: send the line "unsubscribe linux-scsi" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html