Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 01e60527 authored by Steffen Maier's avatar Steffen Maier Committed by James Bottomley
Browse files

[SCSI] zfcp: Bounds checking for deferred error trace 



The pl vector has scount elements, i.e. pl[scount-1] is the last valid
element. For maximum sized requests, payload->counter == scount after
the last loop iteration. Therefore, do bounds checking first (with
boolean shortcut) to not access the invalid element pl[scount].

Do not trust the maximum sbale->scount value from the HBA
but ensure we won't access the pl vector out of our allocated bounds.
While at it, clean up scoping and prevent unnecessary memset.

Minor fix for 86a9668a
"[SCSI] zfcp: support for hardware data router"

Signed-off-by: default avatarSteffen Maier <maier@linux.vnet.ibm.com>
Reviewed-by: default avatarMartin Peschke <mpeschke@linux.vnet.ibm.com>
Cc: <stable@vger.kernel.org> #3.2+
Signed-off-by: default avatarJames Bottomley <JBottomley@Parallels.com>
parent 0100998d

drivers/s390/scsi/zfcp_dbf.c

+1 −1
Original line number Diff line number Diff line
@@ -191,7 +191,7 @@ void zfcp_dbf_hba_def_err(struct zfcp_adapter *adapter, u64 req_id, u16 scount, 
	length = min((u16)sizeof(struct qdio_buffer),

		     (u16)ZFCP_DBF_PAY_MAX_REC);



	while ((char *)pl[payload->counter] && payload->counter < scount) {

	while (payload->counter < scount && (char *)pl[payload->counter]) {

		memcpy(payload->data, (char *)pl[payload->counter], length);

		debug_event(dbf->pay, 1, payload, zfcp_dbf_plen(length));

		payload->counter++;

drivers/s390/scsi/zfcp_qdio.c

+10 −6
Original line number Diff line number Diff line
@@ -102,18 +102,22 @@ static void zfcp_qdio_int_resp(struct ccw_device *cdev, unsigned int qdio_err, 
{

	struct zfcp_qdio *qdio = (struct zfcp_qdio *) parm;

	struct zfcp_adapter *adapter = qdio->adapter;

	struct qdio_buffer_element *sbale;

	int sbal_no, sbal_idx;



	if (unlikely(qdio_err)) {

		if (zfcp_adapter_multi_buffer_active(adapter)) {

			void *pl[ZFCP_QDIO_MAX_SBALS_PER_REQ + 1];

			struct qdio_buffer_element *sbale;

			u64 req_id;

			u8 scount;



	if (unlikely(qdio_err)) {

		memset(pl, 0, ZFCP_QDIO_MAX_SBALS_PER_REQ * sizeof(void *));

		if (zfcp_adapter_multi_buffer_active(adapter)) {

			memset(pl, 0,

			       ZFCP_QDIO_MAX_SBALS_PER_REQ * sizeof(void *));

			sbale = qdio->res_q[idx]->element;

			req_id = (u64) sbale->addr;

			scount = sbale->scount + 1; /* incl. signaling SBAL */

			scount = min(sbale->scount + 1,

				     ZFCP_QDIO_MAX_SBALS_PER_REQ + 1);

				     /* incl. signaling SBAL */



			for (sbal_no = 0; sbal_no < scount; sbal_no++) {

				sbal_idx = (idx + sbal_no) %