Fixes for 5.10

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-5.10/scsi-hpsa-fix-allocation-size-for-scsi_host_alloc.patch b/queue-5.10/scsi-hpsa-fix-allocation-size-for-scsi_host_alloc.patch
new file mode 100644 (file)
index 0000000..d78eb6f
--- /dev/null
+++ b/queue-5.10/scsi-hpsa-fix-allocation-size-for-scsi_host_alloc.patch
@@ -0,0 +1,40 @@
+From 2e6a68f2b08014295bb01b3aeffd086432b85ff0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Jan 2023 06:12:55 +0300
+Subject: scsi: hpsa: Fix allocation size for scsi_host_alloc()
+
+From: Alexey V. Vissarionov <gremlin@altlinux.org>
+
+[ Upstream commit bbbd25499100c810ceaf5193c3cfcab9f7402a33 ]
+
+The 'h' is a pointer to struct ctlr_info, so it's just 4 or 8 bytes, while
+the structure itself is much bigger.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: edd163687ea5 ("hpsa: add driver for HP Smart Array controllers.")
+Link: https://lore.kernel.org/r/20230118031255.GE15213@altlinux.org
+Signed-off-by: Alexey V. Vissarionov <gremlin@altlinux.org>
+Acked-by: Don Brace <don.brace@microchip.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/hpsa.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
+index b2d4b6c78b5c..a44a098dbb9c 100644
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -5834,7 +5834,7 @@ static int hpsa_scsi_host_alloc(struct ctlr_info *h)
+ {
+       struct Scsi_Host *sh;
+ 
+-      sh = scsi_host_alloc(&hpsa_driver_template, sizeof(h));
++      sh = scsi_host_alloc(&hpsa_driver_template, sizeof(struct ctlr_info));
+       if (sh == NULL) {
+               dev_err(&h->pdev->dev, "scsi_host_alloc failed\n");
+               return -ENOMEM;
+-- 
+2.39.0
+

diff --git a/queue-5.10/series b/queue-5.10/series
index c73509c9dd1f87afddfa87bbf76acb7dc78becf7..3b28bff0015f7e4ddb9790e2e42ef8217d5794bc 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -98,3 +98,4 @@ docs-fix-path-paste-o-for-sys-kernel-warn_count.patch
 exit-use-read_once-for-all-oops-warn-limit-reads.patch
 bluetooth-hci_sync-cancel-cmd_timer-if-hci_open-fail.patch
 xhci-set-hcd-flag-to-defer-primary-roothub-registration.patch
+scsi-hpsa-fix-allocation-size-for-scsi_host_alloc.patch