Commit fa068832 authored Jun 30, 2016 by Chris Leech Committed by Martin K. Petersen Jul 13, 2016

libfc: sanity check cpu number extracted from xid



In the receive path libfc extracts a cpu number from the ox_id in the
fiber channel header and uses that to do a per_cpu_ptr conversion.  If,
for some reason, a frame is received with an invalid ox_id, per_cpu_ptr
will return an invalid pointer and the libfc receive path will panic the
system trying to use it.

I'm currently looking at such a case, and I don't yet know why a cpu
number > nr_cpu_ids is appearing in an exchange id.  But adding a sanity
check in libfc prevents a system panic, and seems like good idea when
dealing with frames coming in from the network.

Signed-off-by: Chris Leech <cleech@redhat.com>
Acked-by: Johannes Thumshirn <jth@kernel.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

parent 4b9bc86d

drivers/scsi/libfc/fc_exch.c

+9 −1

Original line number	Diff line number	Diff line
		@@ -908,9 +908,17 @@ static struct fc_exch fc_exch_find(struct fc_exch_mgr mp, u16 xid)
		{
		struct fc_exch_pool *pool;
		struct fc_exch *ep = NULL;
		u16 cpu = xid & fc_cpu_mask;

		if (cpu >= nr_cpu_ids \|\| !cpu_possible(cpu)) {
		printk_ratelimited(KERN_ERR
		"libfc: lookup request for XID = %d, "
		"indicates invalid CPU %d\n", xid, cpu);
		return NULL;
		}

		if ((xid >= mp->min_xid) && (xid <= mp->max_xid)) {
		pool = per_cpu_ptr(mp->pool, xid & fc_cpu_mask);
		pool = per_cpu_ptr(mp->pool, cpu);
		spin_lock_bh(&pool->lock);
		ep = fc_exch_ptr_get(pool, (xid - mp->min_xid) >> fc_cpu_order);
		if (ep) {