mirrors/scst
1
0
Fork 0
mirror of https://github.com/SCST-project/scst.git synced 2026-08-18 21:26:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

qla2x00t-32gbit: Fix unbound NVME response length

Browse Source 
On certain cases when response length is less than 32, NVME response data
is supplied inline in IOCB. This is indicated by some combination of state
flags. There was an instance when a high, and incorrect, response length
was indicated causing driver to overrun buffers. Fix this by checking and
limiting the response payload length.

Fixes: 7401bc18d1ee3 ("scsi: qla2xxx: Add FC-NVMe command handling")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20200124045014.23554-1-hmadhani@marvell.com
Signed-off-by: Arun Easi <aeasi@marvell.com>
Signed-off-by: Himanshu Madhani <hmadhani@marvell.com>
Reviewed-by: Ewan D. Milne <emilne@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

[ commit 00fe717ee1ea3c2979db4f94b1533c57aed8dea9 upstream ]


git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8784 d57e44dd-8a1f-0410-8b47-8ef2f437770f
This commit is contained in:
Bart Van Assche
2020-03-07 21:06:52 +00:00
parent 69d90841b6
commit 98a11ac4cd
3 changed files with 18 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
qla2x00t-32gbit/qla_dbg.c
-6
View File
@@ -2519,12 +2519,6 @@ qla83xx_fw_dump_failed:
/* Driver Debug Functions. */
/****************************************************************************/
static inline int
ql_mask_match(uint level)
{
return (level & ql2xextended_error_logging) == level;
}
/*
* This function is for formatting and logging debug information.
* It is to be used when vha is available. It formats the message
qla2x00t-32gbit/qla_dbg.h
+6
View File
@@ -374,3 +374,9 @@ extern int qla24xx_dump_ram(struct qla_hw_data *, uint32_t, uint32_t *,
extern void qla24xx_pause_risc(struct device_reg_24xx __iomem *,
struct qla_hw_data *);
extern int qla24xx_soft_reset(struct qla_hw_data *);
static inline int
ql_mask_match(uint level)
{
return (level & ql2xextended_error_logging) == level;
}
qla2x00t-32gbit/qla_isr.c
+12
View File
@@ -1959,6 +1959,18 @@ static void qla24xx_nvme_iocb_entry(scsi_qla_host_t *vha, struct req_que *req,
inbuf = (uint32_t *)&sts->nvme_ersp_data;
outbuf = (uint32_t *)fd->rspaddr;
iocb->u.nvme.rsp_pyld_len = le16_to_cpu(sts->nvme_rsp_pyld_len);
if (unlikely(iocb->u.nvme.rsp_pyld_len >
sizeof(struct nvme_fc_ersp_iu))) {
if (ql_mask_match(ql_dbg_io)) {
WARN_ONCE(1, "Unexpected response payload length %u.\n",
iocb->u.nvme.rsp_pyld_len);
ql_log(ql_log_warn, fcport->vha, 0x5100,
"Unexpected response payload length %u.\n",
iocb->u.nvme.rsp_pyld_len);
}
iocb->u.nvme.rsp_pyld_len =
sizeof(struct nvme_fc_ersp_iu);
}
iter = iocb->u.nvme.rsp_pyld_len >> 2;
for (; iter; iter--)
*outbuf++ = swab32(*inbuf++);