lkml.org 
[lkml]   [2007]   [Aug]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 4/6][RESEND] Emulex FC HBA driver: fix overflow of statically allocated array
NACK

The fix is contained in our 8.2.2 sources recently posted and pushed by James
as part of his last scsi fixes.

-- james s

Jesper Juhl wrote:
> (previously send on 09-Aug-2007 20:47)
>
> Hi,
>
> The Coverity checker noticed that we may overrun a statically allocated
> array in drivers/scsi/lpfc/lpfc_sli.c::lpfc_sli_hbqbuf_find().
>
> The case is this; In 'struct lpfc_hba' we have
>
> #define LPFC_MAX_HBQS 4
> ...
> struct lpfc_hba {
> ...
> struct hbq_s hbqs[LPFC_MAX_HBQS];
> ...
> };
>
> But then in lpfc_sli_hbqbuf_find() we have this code
>
> hbqno = tag >> 16;
> if (hbqno > LPFC_MAX_HBQS)
> return NULL;
>
> if 'hbqno' ends up as exactely 4, then we won't return, and then this
>
> list_for_each_entry(d_buf, &phba->hbqs[hbqno].hbq_buffer_list, list) {
>
> will cause an overflow of the statically allocated array at index 4,
> since the valid indices are only 0-3.
>
> I propose this patch, that simply changes the 'hbqno > LPFC_MAX_HBQS'
> into 'hbqno >= LPFC_MAX_HBQS' as a possible fix.
>
>
> Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
> Acked-by: James Smart <james.smart@emulex.com>
> ---
>
> drivers/scsi/lpfc/lpfc_sli.c | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
> index ce5ff2b..e5337ad 100644
> --- a/drivers/scsi/lpfc/lpfc_sli.c
> +++ b/drivers/scsi/lpfc/lpfc_sli.c
> @@ -675,7 +675,7 @@ lpfc_sli_hbqbuf_find(struct lpfc_hba *phba, uint32_t tag)
> uint32_t hbqno;
>
> hbqno = tag >> 16;
> - if (hbqno > LPFC_MAX_HBQS)
> + if (hbqno >= LPFC_MAX_HBQS)
> return NULL;
>
> list_for_each_entry(d_buf, &phba->hbqs[hbqno].hbq_buffer_list, list) {
>
>
>
>
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2007-08-13 16:07    [W:0.065 / U:0.248 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site