From 1ba9b34529b0934ad9ee3bf3d9e7d5c452610fdd Mon Sep 17 00:00:00 2001 From: Bart Van Assche Date: Mon, 11 Feb 2019 00:05:44 +0000 Subject: [PATCH 1/6] scst_vdisk: Add a consistency check git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@7912 d57e44dd-8a1f-0410-8b47-8ef2f437770f --- scst/src/dev_handlers/scst_vdisk.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/scst/src/dev_handlers/scst_vdisk.c b/scst/src/dev_handlers/scst_vdisk.c index 2ec0d1177..9ec6e4af6 100644 --- a/scst/src/dev_handlers/scst_vdisk.c +++ b/scst/src/dev_handlers/scst_vdisk.c @@ -3322,6 +3322,8 @@ static enum compl_status_e fileio_exec_async(struct vdisk_cmd_params *p) length = scst_get_buf_next(cmd, &address); } + WARN_ON_ONCE(kvec - p->async.kvec != scst_get_buf_count(cmd)); + #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 20, 0) iov_iter_kvec(&iter, dir, p->async.kvec, kvec - p->async.kvec, total); #else From 3eb582b50e330418992b92d336066dc1a7b005e5 Mon Sep 17 00:00:00 2001 From: Bart Van Assche Date: Mon, 11 Feb 2019 00:07:10 +0000 Subject: [PATCH 2/6] scst_sysfs: Fix a smatch warning Avoid that smatch complains about using a variable before a NULL test. git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@7913 d57e44dd-8a1f-0410-8b47-8ef2f437770f --- scst/src/scst_sysfs.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/scst/src/scst_sysfs.c b/scst/src/scst_sysfs.c index 6944b0995..b41296141 100644 --- a/scst/src/scst_sysfs.c +++ b/scst/src/scst_sysfs.c @@ -4359,8 +4359,10 @@ static ssize_t scst_sess_latency_show(struct kobject *kobj, for (k = 0; k < SCST_CMD_STATE_COUNT; k++) { struct scst_lat_stats *lat_stats = sess->lat_stats; + if (!lat_stats || res >= PAGE_SIZE) + continue; d = &lat_stats->ls[i][j][k]; - if (!lat_stats || d->count == 0 || res >= PAGE_SIZE) + if (d->count == 0) continue; scst_get_cmd_state_name(state_name, sizeof(state_name), k); From e730c8cd583475e307a128afaa254ce505210a8e Mon Sep 17 00:00:00 2001 From: Bart Van Assche Date: Mon, 11 Feb 2019 00:08:28 +0000 Subject: [PATCH 3/6] scst_user: Introduce a helper function This patch does not change any functionality. git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@7914 d57e44dd-8a1f-0410-8b47-8ef2f437770f --- scst/src/dev_handlers/scst_user.c | 39 ++++++++++++++++++------------- 1 file changed, 23 insertions(+), 16 deletions(-) diff --git a/scst/src/dev_handlers/scst_user.c b/scst/src/dev_handlers/scst_user.c index 628e1c0b4..8fb443814 100644 --- a/scst/src/dev_handlers/scst_user.c +++ b/scst/src/dev_handlers/scst_user.c @@ -3953,6 +3953,28 @@ out: return 0; } +#ifdef CONFIG_SCST_EXTRACHECKS +static void dev_user_check_lost_ucmds(struct scst_user_dev *dev) +{ + int i; + + for (i = 0; i < (int)ARRAY_SIZE(dev->ucmd_hash); i++) { + struct list_head *head = &dev->ucmd_hash[i]; + struct scst_user_cmd *ucmd2, *tmp; + + list_for_each_entry_safe(ucmd2, tmp, head, hash_list_entry) { + PRINT_ERROR("Lost ucmd %p (state %x, ref %d)", ucmd2, + ucmd2->state, atomic_read(&ucmd2->ucmd_ref)); + ucmd_put(ucmd2); + } + } +} +#else +static void dev_user_check_lost_ucmds(struct scst_user_dev *dev) +{ +} +#endif + static int dev_user_process_cleanup(struct scst_user_dev *dev) { struct scst_user_cmd *ucmd; @@ -3988,22 +4010,7 @@ static int dev_user_process_cleanup(struct scst_user_dev *dev) } } -#ifdef CONFIG_SCST_EXTRACHECKS -{ - int i; - - for (i = 0; i < (int)ARRAY_SIZE(dev->ucmd_hash); i++) { - struct list_head *head = &dev->ucmd_hash[i]; - struct scst_user_cmd *ucmd2, *tmp; - - list_for_each_entry_safe(ucmd2, tmp, head, hash_list_entry) { - PRINT_ERROR("Lost ucmd %p (state %x, ref %d)", ucmd2, - ucmd2->state, atomic_read(&ucmd2->ucmd_ref)); - ucmd_put(ucmd2); - } - } -} -#endif + dev_user_check_lost_ucmds(dev); TRACE_DBG("Cleanuping done (dev %p)", dev); complete_all(&dev->cleanup_cmpl); From 77d9c561d5e76874dccfa78590e8e4224221c196 Mon Sep 17 00:00:00 2001 From: Bart Van Assche Date: Mon, 11 Feb 2019 00:09:33 +0000 Subject: [PATCH 4/6] scst_pres: Avoid reading past the end of a buffer Detected by smatch. git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@7915 d57e44dd-8a1f-0410-8b47-8ef2f437770f --- scst/src/scst_pres.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scst/src/scst_pres.c b/scst/src/scst_pres.c index d77fec6bd..1f69d1380 100644 --- a/scst/src/scst_pres.c +++ b/scst/src/scst_pres.c @@ -762,7 +762,7 @@ static int scst_pr_do_load_device_file(struct scst_device *dev, } pos += sizeof(version); - while (data_size < file_size) { + while (data_size + 1 < file_size) { uint8_t *tid; data_size++; @@ -794,7 +794,7 @@ static int scst_pr_do_load_device_file(struct scst_device *dev, dev->pr_scope = buf[pos]; pos += sizeof(dev->pr_scope); - while (pos < file_size) { + while (pos + 1 < file_size) { uint8_t is_holder; uint8_t *tid; struct scst_dev_registrant *reg = NULL; From 42e88fc0baad0ed74a484cc96f9057f8b353eae9 Mon Sep 17 00:00:00 2001 From: Bart Van Assche Date: Mon, 11 Feb 2019 00:10:12 +0000 Subject: [PATCH 5/6] scst: Use sg_virt() where appropriate This patch does not change any functionality. git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@7916 d57e44dd-8a1f-0410-8b47-8ef2f437770f --- scst/include/scst.h | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/scst/include/scst.h b/scst/include/scst.h index 61273fecf..78c0d1973 100644 --- a/scst/include/scst.h +++ b/scst/include/scst.h @@ -5043,9 +5043,7 @@ static inline int __scst_get_buf(struct scst_cmd *cmd, int sg_cnt, goto out; } - *buf = page_address(sg_page(sg)); - *buf += sg->offset; - + *buf = sg_virt(sg); res = sg->length; cmd->get_sg_buf_entry_num++; From 1f2e6e0113b1d3b673108d22e49aef2ab8fdb045 Mon Sep 17 00:00:00 2001 From: Bart Van Assche Date: Mon, 11 Feb 2019 00:11:01 +0000 Subject: [PATCH 6/6] qla2x00t: Fix an out of bounds access Avoid that KASAN reports the following: BUG: KASAN: stack-out-of-bounds in q2t_async_event+0x27c/0x3a0 [qla2x00tgt] Read of size 2 at addr ffff8880db407db0 by task swapper/0/0 CPU: 0 PID: 0 Comm: swapper/0 Tainted: G O 4.19.19-dbg+ #1 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Call Trace: dump_stack+0xa4/0xfa print_address_description+0x71/0x239 kasan_report.cold.6+0x242/0x301 __asan_load2+0x51/0x80 q2t_async_event+0x27c/0x3a0 [qla2x00tgt] qla2x00_async_event+0x34f/0x2390 [qla2xxx_scst] qla24xx_msix_default+0x2b8/0x300 [qla2xxx_scst] __handle_irq_event_percpu+0x77/0x3c0 handle_irq_event_percpu+0x68/0xe0 handle_irq_event+0x5a/0x8b handle_edge_irq+0x114/0x2f0 handle_irq+0x18d/0x205 do_IRQ+0x73/0x150 common_interrupt+0xf/0xf git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@7917 d57e44dd-8a1f-0410-8b47-8ef2f437770f --- qla2x00t/qla2x00-target/qla2x00t.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/qla2x00t/qla2x00-target/qla2x00t.c b/qla2x00t/qla2x00-target/qla2x00t.c index 9720c1499..99ad5ca67 100644 --- a/qla2x00t/qla2x00-target/qla2x00t.c +++ b/qla2x00t/qla2x00-target/qla2x00t.c @@ -5752,10 +5752,10 @@ static void q2t_async_event(uint16_t code, scsi_qla_host_t *vha, default: TRACE(TRACE_MGMT, "qla2x00t(%ld): Async event %#x occurred: " - "ignoring (m[1]=%x, m[2]=%x, m[3]=%x, m[4]=%x)", + "ignoring (m[0]=%x, m[1]=%x, m[2]=%x, m[3]=%x)", vha->host_no, code, - le16_to_cpu(mailbox[1]), le16_to_cpu(mailbox[2]), - le16_to_cpu(mailbox[3]), le16_to_cpu(mailbox[4])); + le16_to_cpu(mailbox[0]), le16_to_cpu(mailbox[1]), + le16_to_cpu(mailbox[2]), le16_to_cpu(mailbox[3])); break; }