releases/4.14.34/scsi-megaraid_sas-error-handling-for-invalid-ldcount-provided-by-firmware-in-raid-map.patch

   1 From foo@baz Mon Apr  9 13:58:16 CEST 2018
   2 From: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
   3 Date: Fri, 5 Jan 2018 05:27:40 -0800
   4 Subject: scsi: megaraid_sas: Error handling for invalid ldcount provided by firmware in RAID map
   5
   6 From: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
   7
   8
   9 [ Upstream commit 7ada701d0d5e5c6d357e157a72b841db3e8d03f4 ]
  10
  11 Currently driver does not validate ldcount provided by firmware.  If the
  12 value is invalid, fail RAID map validation accordingly.  This issue is
  13 rare to hit in field and is fixed as part of code review.
  14
  15 Signed-off-by: Sumit Saxena <sumit.saxena@broadcom.com>
  16 Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
  17 Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
  18 Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
  19 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  20 ---
  21  drivers/scsi/megaraid/megaraid_sas_fp.c |   16 ++++++++++++----
  22  1 file changed, 12 insertions(+), 4 deletions(-)
  23
  24 --- a/drivers/scsi/megaraid/megaraid_sas_fp.c
  25 +++ b/drivers/scsi/megaraid/megaraid_sas_fp.c
  26 @@ -168,7 +168,7 @@ static struct MR_LD_SPAN *MR_LdSpanPtrGe
  27  /*
  28   * This function will Populate Driver Map using firmware raid map
  29   */
  30 -void MR_PopulateDrvRaidMap(struct megasas_instance *instance)
  31 +static int MR_PopulateDrvRaidMap(struct megasas_instance *instance)
  32  {
  33         struct fusion_context *fusion = instance->ctrl_context;
  34         struct MR_FW_RAID_MAP_ALL     *fw_map_old    = NULL;
  35 @@ -259,7 +259,7 @@ void MR_PopulateDrvRaidMap(struct megasa
  36                 ld_count = (u16)le16_to_cpu(fw_map_ext->ldCount);
  37                 if (ld_count > MAX_LOGICAL_DRIVES_EXT) {
  38                         dev_dbg(&instance->pdev->dev, "megaraid_sas: LD count exposed in RAID map in not valid\n");
  39 -                       return;
  40 +                       return 1;
  41                 }
  42
  43                 pDrvRaidMap->ldCount = (__le16)cpu_to_le16(ld_count);
  44 @@ -285,6 +285,12 @@ void MR_PopulateDrvRaidMap(struct megasa
  45                         fusion->ld_map[(instance->map_id & 1)];
  46                 pFwRaidMap = &fw_map_old->raidMap;
  47                 ld_count = (u16)le32_to_cpu(pFwRaidMap->ldCount);
  48 +               if (ld_count > MAX_LOGICAL_DRIVES) {
  49 +                       dev_dbg(&instance->pdev->dev,
  50 +                               "LD count exposed in RAID map in not valid\n");
  51 +                       return 1;
  52 +               }
  53 +
  54                 pDrvRaidMap->totalSize = pFwRaidMap->totalSize;
  55                 pDrvRaidMap->ldCount = (__le16)cpu_to_le16(ld_count);
  56                 pDrvRaidMap->fpPdIoTimeoutSec = pFwRaidMap->fpPdIoTimeoutSec;
  57 @@ -300,6 +306,8 @@ void MR_PopulateDrvRaidMap(struct megasa
  58                         sizeof(struct MR_DEV_HANDLE_INFO) *
  59                         MAX_RAIDMAP_PHYSICAL_DEVICES);
  60         }
  61 +
  62 +       return 0;
  63  }
  64
  65  /*
  66 @@ -317,8 +325,8 @@ u8 MR_ValidateMapInfo(struct megasas_ins
  67         u16 ld;
  68         u32 expected_size;
  69
  70 -
  71 -       MR_PopulateDrvRaidMap(instance);
  72 +       if (MR_PopulateDrvRaidMap(instance))
  73 +               return 0;
  74
  75         fusion = instance->ctrl_context;
  76         drv_map = fusion->ld_drv_map[(instance->map_id & 1)];