lkml.org 
[lkml]   [2018]   [May]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 105/165] scsi: qla2xxx: Avoid triggering undefined behavior in qla2x00_mbx_completion()
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Bart Van Assche <bart.vanassche@wdc.com>

    [ Upstream commit c02189e12ce3bf3808cb880569d3b10249f50bd9 ]

    A left shift must shift less than the bit width of the left argument.
    Avoid triggering undefined behavior if ha->mbx_count == 32.

    This patch avoids that UBSAN reports the following complaint:

    UBSAN: Undefined behaviour in drivers/scsi/qla2xxx/qla_isr.c:275:14
    shift exponent 32 is too large for 32-bit type 'int'
    Call Trace:
    dump_stack+0x4e/0x6c
    ubsan_epilogue+0xd/0x3b
    __ubsan_handle_shift_out_of_bounds+0x112/0x14c
    qla2x00_mbx_completion+0x1c5/0x25d [qla2xxx]
    qla2300_intr_handler+0x1ea/0x3bb [qla2xxx]
    qla2x00_mailbox_command+0x77b/0x139a [qla2xxx]
    qla2x00_mbx_reg_test+0x83/0x114 [qla2xxx]
    qla2x00_chip_diag+0x354/0x45f [qla2xxx]
    qla2x00_initialize_adapter+0x2c2/0xa4e [qla2xxx]
    qla2x00_probe_one+0x1681/0x392e [qla2xxx]
    pci_device_probe+0x10b/0x1f1
    driver_probe_device+0x21f/0x3a4
    __driver_attach+0xa9/0xe1
    bus_for_each_dev+0x6e/0xb5
    driver_attach+0x22/0x3c
    bus_add_driver+0x1d1/0x2ae
    driver_register+0x78/0x130
    __pci_register_driver+0x75/0xa8
    qla2x00_module_init+0x21b/0x267 [qla2xxx]
    do_one_initcall+0x5a/0x1e2
    do_init_module+0x9d/0x285
    load_module+0x20db/0x38e3
    SYSC_finit_module+0xa8/0xbc
    SyS_finit_module+0x9/0xb
    do_syscall_64+0x77/0x271
    entry_SYSCALL64_slow_path+0x25/0x25

    Reported-by: Meelis Roos <mroos@linux.ee>
    Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
    Cc: Himanshu Madhani <himanshu.madhani@cavium.com>
    Reviewed-by: Laurence Oberman <loberman@redhat.com>
    Acked-by: Himanshu Madhani <himanshu.madhani@cavium.com>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/scsi/qla2xxx/qla_isr.c | 6 ++++--
    1 file changed, 4 insertions(+), 2 deletions(-)

    --- a/drivers/scsi/qla2xxx/qla_isr.c
    +++ b/drivers/scsi/qla2xxx/qla_isr.c
    @@ -272,7 +272,8 @@ qla2x00_mbx_completion(scsi_qla_host_t *
    struct device_reg_2xxx __iomem *reg = &ha->iobase->isp;

    /* Read all mbox registers? */
    - mboxes = (1 << ha->mbx_count) - 1;
    + WARN_ON_ONCE(ha->mbx_count > 32);
    + mboxes = (1ULL << ha->mbx_count) - 1;
    if (!ha->mcp)
    ql_dbg(ql_dbg_async, vha, 0x5001, "MBX pointer ERROR.\n");
    else
    @@ -2821,7 +2822,8 @@ qla24xx_mbx_completion(scsi_qla_host_t *
    struct device_reg_24xx __iomem *reg = &ha->iobase->isp24;

    /* Read all mbox registers? */
    - mboxes = (1 << ha->mbx_count) - 1;
    + WARN_ON_ONCE(ha->mbx_count > 32);
    + mboxes = (1ULL << ha->mbx_count) - 1;
    if (!ha->mcp)
    ql_dbg(ql_dbg_async, vha, 0x504e, "MBX pointer ERROR.\n");
    else

    \
     
     \ /
      Last update: 2018-05-24 12:59    [W:4.230 / U:0.752 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site