linux-kernel - [PATCH 4.13 060/109] scsi: megaraid_sas: mismatch of allocated MFI frame size and length exposed in MFI MPT pass through command

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 24 Sep 2017 22:33:21 +0200
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     linux-kernel@...r.kernel.org
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        stable@...r.kernel.org, Kashyap Desai <kashyap.desai@...adcom.com>,
        Shivasharan S <shivasharan.srikanteshwara@...adcom.com>,
        Hannes Reinecke <hare@...e.com>,
        Tomas Henzl <thenzl@...hat.com>,
        "Martin K. Petersen" <martin.petersen@...cle.com>
Subject: [PATCH 4.13 060/109] scsi: megaraid_sas: mismatch of allocated MFI frame size and length exposed in MFI MPT pass through command

4.13-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Shivasharan S <shivasharan.srikanteshwara@...adcom.com>

commit ed2983f458bed9dc827ec60c8486253b1669bb52 upstream.

Driver allocated 256 byte MFI frames bytes but while sending MFI frame
(embedded inside chain frame of MPT frame) to firmware, driver sets the
length as 4k. This results in DMA read error messages during boot.

Signed-off-by: Kashyap Desai <kashyap.desai@...adcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@...adcom.com>
Reviewed-by: Hannes Reinecke <hare@...e.com>
Reviewed-by: Tomas Henzl <thenzl@...hat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@...cle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>

---
 drivers/scsi/megaraid/megaraid_sas_fusion.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
@@ -3287,7 +3287,7 @@ build_mpt_mfi_pass_thru(struct megasas_i
 	mpi25_ieee_chain->Flags = IEEE_SGE_FLAGS_CHAIN_ELEMENT |
 		MPI2_IEEE_SGE_FLAGS_IOCPLBNTA_ADDR;

-	mpi25_ieee_chain->Length = cpu_to_le32(instance->max_chain_frame_sz);
+	mpi25_ieee_chain->Length = cpu_to_le32(instance->mfi_frame_size);
 }

 /**