linux-kernel - [PATCH] scsi: message: fusion: Fix out-of-bounds shift in phy bitmask calculation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20250220091436.17412-1-pchelkin@ispras.ru>
Date: Thu, 20 Feb 2025 12:14:35 +0300
From: Fedor Pchelkin <pchelkin@...ras.ru>
To: Sathya Prakash <sathya.prakash@...adcom.com>,
	Sreekanth Reddy <sreekanth.reddy@...adcom.com>,
	"Martin K. Petersen" <martin.petersen@...cle.com>
Cc: Fedor Pchelkin <pchelkin@...ras.ru>,
	Suganath Prabu Subramani <suganath-prabu.subramani@...adcom.com>,
	Eric Moore <eric.moore@...l.com>,
	James Bottomley <James.Bottomley@...senPartnership.com>,
	"Bart Van Assche" <bvanassche@....org>,
	MPT-FusionLinux.pdl@...adcom.com,
	linux-scsi@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	lvc-project@...uxtesting.org,
	stable@...r.kernel.org,
	Aleksandr Mishin <amishin@...rgos.ru>
Subject: [PATCH] scsi: message: fusion: Fix out-of-bounds shift in phy bitmask calculation

In mptsas_setup_wide_ports() the calculation of phy bitmask is a subject
to undefined behavior when phy index exceeds the width of type 'int', but
is still less than 64.

Utilize BIT_ULL macro to fix this.

Found by Linux Verification Center (linuxtesting.org) with SVACE static
analysis tool.

Fixes: 547f9a218436 ("[SCSI] mptsas: wide port support")
Cc: stable@...r.kernel.org
Co-developed-by: Aleksandr Mishin <amishin@...rgos.ru>
Signed-off-by: Aleksandr Mishin <amishin@...rgos.ru>
Signed-off-by: Fedor Pchelkin <pchelkin@...ras.ru>
---
struct mptsas_portinfo_details::phy_bitmask is used only in various
logging printks throughout the driver. Another option would be to drop
this field completely if it is considered a more appropriate solution..

 drivers/message/fusion/mptsas.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/message/fusion/mptsas.c b/drivers/message/fusion/mptsas.c
index 7e79da9684ed..cd95655f1592 100644
--- a/drivers/message/fusion/mptsas.c
+++ b/drivers/message/fusion/mptsas.c
@@ -43,6 +43,7 @@
 */
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
 
+#include <linux/bits.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/slab.h>
@@ -880,7 +881,7 @@ mptsas_setup_wide_ports(MPT_ADAPTER *ioc, struct mptsas_portinfo *port_info)
 		    "%s: [%p]: deleting phy = %d\n",
 		    ioc->name, __func__, port_details, i));
 		port_details->num_phys--;
-		port_details->phy_bitmask &= ~ (1 << phy_info->phy_id);
+		port_details->phy_bitmask &= ~BIT_ULL(phy_info->phy_id);
 		memset(&phy_info->attached, 0, sizeof(struct mptsas_devinfo));
 		if (phy_info->phy) {
 			devtprintk(ioc, dev_printk(KERN_DEBUG,
@@ -915,7 +916,7 @@ mptsas_setup_wide_ports(MPT_ADAPTER *ioc, struct mptsas_portinfo *port_info)
 			port_details->port_info = port_info;
 			if (phy_info->phy_id < 64 )
 				port_details->phy_bitmask |=
-				    (1 << phy_info->phy_id);
+					BIT_ULL(phy_info->phy_id);
 			phy_info->sas_port_add_phy=1;
 			dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "\t\tForming port\n\t\t"
 			    "phy_id=%d sas_address=0x%018llX\n",
@@ -957,7 +958,7 @@ mptsas_setup_wide_ports(MPT_ADAPTER *ioc, struct mptsas_portinfo *port_info)
 			phy_info_cmp->port_details = port_details;
 			if (phy_info_cmp->phy_id < 64 )
 				port_details->phy_bitmask |=
-				(1 << phy_info_cmp->phy_id);
+					BIT_ULL(phy_info_cmp->phy_id);
 			port_details->num_phys++;
 		}
 	}
-- 
2.48.1