cciss: fix a couple minor bugs
cover cciss: fix a couple minor bugs
The following fixes a couple of minor bugs in the cciss driver.
---
Stephen M. Cameron (2):
cciss: Use the correct size when mapping in the config table
cciss: fix potential overrun while memcpy'ing sense data
Signature · 1 line
-- steve
PATCH 1/2 cciss: Use the correct size when mapping in the config table
From: Stephen M. Cameron <[email protected]>
--- drivers/block/cciss.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
drivers/block/cciss.c +1 -1
@@ -4185,7 +4185,7 @@ static int __devinit cciss_find_cfgtables(ctlr_info_t *h)if (rc)return rc; h->cfgtable =remap_pci_mem (pci_resource_start (h->pdev, - cfg_base_addr_index) + cfg_offset,sizeof (h->cfgtable)); + cfg_base_addr_index) + cfg_offset,sizeof (*h->cfgtable));if (!h->cfgtable)return -ENOMEM ; rc =write_driver_ver_to_cfgtable (h->cfgtable);
PATCH 2/2 cciss: fix potential overrun while memcpy'ing sense data
In reply to Stephen M. CameronFrom: Stephen M. Cameron <[email protected]>
This memcpy:
memcpy(cmd->sense_buffer, ei->SenseInfo,
ei->SenseLen > SCSI_SENSE_BUFFERSIZE ?
SCSI_SENSE_BUFFERSIZE :
ei->SenseLen);The ei->SenseLen field is filled in by the Smart Array. For requests to logical drives, it will not exceed 32 bytes, so should be ok, but for physical requests it depends on the target device, not the Smart Array. It's conceivable that this could exceed the 32 byte size of ei->SenseInfo. In that case, the memcpy would read past the end of ei->SenseInfo, copying data from the next command, as if it were sense data, or, if it happened to be the very last command in the block of allocated commands, could fall off the end of the allocated area and crash. I'm not aware of anyone ever encountering this behavior, but it could conceivably happen. This bug was found by Coverity.
--- drivers/block/cciss_scsi.c | 12 ++++++++---- 1 files changed, 8 insertions(+), 4 deletions(-)
drivers/block/cciss_scsi.c +8 -4
@@ -726,6 +726,7 @@ static void complete_scsi_command(CommandList_struct *c, int timeout,struct scsi_cmnd *cmd;ctlr_info_t *h;ErrorInfo_struct *ei; +unsigned long sense_data_size; ei = c->err_info;
@@ -750,11 +751,14 @@ static void complete_scsi_command(CommandList_struct *c, int timeout,/* printk("Scsistatus is 0x%02x\n", ei->ScsiStatus); */ /* copy the sense data whether we need to or not. */ +if (SCSI_SENSE_BUFFERSIZE <sizeof (ei->SenseInfo)) + sense_data_size =SCSI_SENSE_BUFFERSIZE ; +else + sense_data_size =sizeof (ei->SenseInfo); +if (ei->SenseLen < sense_data_size) + sense_data_size = ei->SenseLen; -memcpy (cmd->sense_buffer, ei->SenseInfo, - ei->SenseLen >SCSI_SENSE_BUFFERSIZE ? -SCSI_SENSE_BUFFERSIZE : - ei->SenseLen); +memcpy (cmd->sense_buffer, ei->SenseInfo, sense_data_size);scsi_set_resid (cmd, ei->ResidualCnt);if (ei->CommandStatus !=0 )