Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9900e06a authored by Harshvardhan Jha's avatar Harshvardhan Jha Committed by Sasha Levin
Browse files

scsi: megaraid_mm: Fix end of loop tests for list_for_each_entry() 

[ Upstream commit 77541f78eadfe9fdb018a7b8b69f0f2af2cf4b82 ]

The list_for_each_entry() iterator, "adapter" in this code, can never be
NULL.  If we exit the loop without finding the correct adapter then
"adapter" points invalid memory that is an offset from the list head.  This
will eventually lead to memory corruption and presumably a kernel crash.

Link: https://lore.kernel.org/r/20210708074642.23599-1-harshvardhan.jha@oracle.com


Acked-by: default avatarSumit Saxena <sumit.saxena@broadcom.com>
Signed-off-by: default avatarHarshvardhan Jha <harshvardhan.jha@oracle.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent e37cf26b

drivers/scsi/megaraid/megaraid_mm.c

+15 −6
Original line number Diff line number Diff line
@@ -246,7 +246,7 @@ mraid_mm_get_adapter(mimd_t __user *umimd, int *rval) 
	mimd_t		mimd;

	uint32_t	adapno;

	int		iterator;



	bool		is_found;



	if (copy_from_user(&mimd, umimd, sizeof(mimd_t))) {

		*rval = -EFAULT;
@@ -262,12 +262,16 @@ mraid_mm_get_adapter(mimd_t __user *umimd, int *rval) 


	adapter = NULL;

	iterator = 0;

	is_found = false;



	list_for_each_entry(adapter, &adapters_list_g, list) {

		if (iterator++ == adapno) break;

		if (iterator++ == adapno) {

			is_found = true;

			break;

		}

	}



	if (!adapter) {

	if (!is_found) {

		*rval = -ENODEV;

		return NULL;

	}
@@ -733,6 +737,7 @@ ioctl_done(uioc_t *kioc) 
	uint32_t	adapno;

	int		iterator;

	mraid_mmadp_t*	adapter;

	bool		is_found;



	/*

	 * When the kioc returns from driver, make sure it still doesn't
@@ -755,19 +760,23 @@ ioctl_done(uioc_t *kioc) 
		iterator	= 0;

		adapter		= NULL;

		adapno		= kioc->adapno;

		is_found	= false;



		con_log(CL_ANN, ( KERN_WARNING "megaraid cmm: completed "

					"ioctl that was timedout before\n"));



		list_for_each_entry(adapter, &adapters_list_g, list) {

			if (iterator++ == adapno) break;

			if (iterator++ == adapno) {

				is_found = true;

				break;

			}

		}



		kioc->timedout = 0;



		if (adapter) {

		if (is_found)

			mraid_mm_dealloc_kioc( adapter, kioc );

		}



	}

	else {

		wake_up(&wait_q);