xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

scsi: megaraid_mm: Fix end of loop tests for list_for_each_entry()

Browse Source 
[ Upstream commit 77541f78eadfe9fdb018a7b8b69f0f2af2cf4b82 ]

The list_for_each_entry() iterator, "adapter" in this code, can never be
NULL.  If we exit the loop without finding the correct adapter then
"adapter" points invalid memory that is an offset from the list head.  This
will eventually lead to memory corruption and presumably a kernel crash.

Link: https://lore.kernel.org/r/20210708074642.23599-1-harshvardhan.jha@oracle.com
Acked-by: Sumit Saxena <sumit.saxena@broadcom.com>
Signed-off-by: Harshvardhan Jha <harshvardhan.jha@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Harshvardhan Jha
2021-07-08 13:16:42 +05:30
committed by Sasha Levin
parent 968ee9176a
commit cc312fa7e6
1 changed files with 15 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
drivers/scsi/megaraid/megaraid_mm.c
View File

@@ -238,7 +238,7 @@ mraid_mm_get_adapter(mimd_t __user *umimd, int *rval)
mimd_t mimd; mimd_t mimd;
uint32_t adapno; uint32_t adapno;
int iterator; int iterator;
bool is_found;
if (copy_from_user(&mimd, umimd, sizeof(mimd_t))) { if (copy_from_user(&mimd, umimd, sizeof(mimd_t))) {
*rval = -EFAULT; *rval = -EFAULT;
@@ -254,12 +254,16 @@ mraid_mm_get_adapter(mimd_t __user *umimd, int *rval)
adapter = NULL; adapter = NULL;
iterator = 0; iterator = 0;
is_found = false;
list_for_each_entry(adapter, &adapters_list_g, list) { list_for_each_entry(adapter, &adapters_list_g, list) {
if (iterator++ == adapno) break; if (iterator++ == adapno) {
is_found = true;
break;
}
} }
if (!adapter) { if (!is_found) {
*rval = -ENODEV; *rval = -ENODEV;
return NULL; return NULL;
} }
@@ -725,6 +729,7 @@ ioctl_done(uioc_t *kioc)
uint32_t adapno; uint32_t adapno;
int iterator; int iterator;
mraid_mmadp_t* adapter; mraid_mmadp_t* adapter;
bool is_found;
/* /*
* When the kioc returns from driver, make sure it still doesn't * When the kioc returns from driver, make sure it still doesn't
@@ -747,19 +752,23 @@ ioctl_done(uioc_t *kioc)
iterator = 0; iterator = 0;
adapter = NULL; adapter = NULL;
adapno = kioc->adapno; adapno = kioc->adapno;
is_found = false;
con_log(CL_ANN, ( KERN_WARNING "megaraid cmm: completed " con_log(CL_ANN, ( KERN_WARNING "megaraid cmm: completed "
"ioctl that was timedout before\n")); "ioctl that was timedout before\n"));
list_for_each_entry(adapter, &adapters_list_g, list) { list_for_each_entry(adapter, &adapters_list_g, list) {
if (iterator++ == adapno) break; if (iterator++ == adapno) {
is_found = true;
break;
}
} }
kioc->timedout = 0; kioc->timedout = 0;
if (adapter) { if (is_found)
mraid_mm_dealloc_kioc( adapter, kioc ); mraid_mm_dealloc_kioc( adapter, kioc );
}
} }
else { else {
wake_up(&wait_q); wake_up(&wait_q);