kernel.git/drivers/scsi/pmcraid.c, branch linux-2.6.33.y

pmcraid: reject negative request size

2011-08-08T17:35:58Z

commit b5b515445f4f5a905c5dd27e6e682868ccd6c09d upstream. There's a code path in pmcraid that can be reached via device ioctl that causes all sorts of ugliness, including heap corruption or triggering the OOM killer due to consecutive allocation of large numbers of pages. First, the user can call pmcraid_chr_ioctl(), with a type PMCRAID_PASSTHROUGH_IOCTL. This calls through to pmcraid_ioctl_passthrough(). Next, a pmcraid_passthrough_ioctl_buffer is copied in, and the request_size variable is set to buffer->ioarcb.data_transfer_length, which is an arbitrary 32-bit signed value provided by the user. If a negative value is provided here, bad things can happen. For example, pmcraid_build_passthrough_ioadls() is called with this request_size, which immediately calls pmcraid_alloc_sglist() with a negative size. The resulting math on allocating a scatter list can result in an overflow in the kzalloc() call (if num_elem is 0, the sglist will be smaller than expected), or if num_elem is unexpectedly large the subsequent loop will call alloc_pages() repeatedly, a high number of pages will be allocated and the OOM killer might be invoked. It looks like preventing this value from being negative in pmcraid_ioctl_passthrough() would be sufficient. Signed-off-by: Dan Rosenberg Signed-off-by: Andrew Morton Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman

pmcraid: reject negative request size

2011-05-09T23:04:42Z

commit 5f6279da3760ce48f478f2856aacebe0c59a39f3 upstream. There's a code path in pmcraid that can be reached via device ioctl that causes all sorts of ugliness, including heap corruption or triggering the OOM killer due to consecutive allocation of large numbers of pages. Not especially relevant from a security perspective, since users must have CAP_SYS_ADMIN to open the character device. First, the user can call pmcraid_chr_ioctl() with a type PMCRAID_PASSTHROUGH_IOCTL. A pmcraid_passthrough_ioctl_buffer is copied in, and the request_size variable is set to buffer->ioarcb.data_transfer_length, which is an arbitrary 32-bit signed value provided by the user. If a negative value is provided here, bad things can happen. For example, pmcraid_build_passthrough_ioadls() is called with this request_size, which immediately calls pmcraid_alloc_sglist() with a negative size. The resulting math on allocating a scatter list can result in an overflow in the kzalloc() call (if num_elem is 0, the sglist will be smaller than expected), or if num_elem is unexpectedly large the subsequent loop will call alloc_pages() repeatedly, a high number of pages will be allocated and the OOM killer might be invoked. Prevent this value from being negative in pmcraid_ioctl_passthrough(). Signed-off-by: Dan Rosenberg Cc: Anil Ravindranath Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman

[SCSI] pmcraid: fix to avoid twice scsi_dma_unmap for a command

2009-12-30T17:53:22Z

For a particular driver error condition, driver was doing double scsi_dma_unmaps. Driver was calling scsi_dma_unmap in pmcraid_error_handler and return 0. This pmcraid_error_handler is called by pmcraid_io_done which will do scsi_dma_unmap again when it has return 0 from pmcraid_error_handler. Signed-off-by: James Bottomley

[SCSI] pmcraid: support SMI-S object model of storage pool

2009-12-10T14:54:12Z

PMC-Sierra mgmt application uses SMI-S model. According to SMI-S, the object model exposed by the SMI-S provider should show an StoragePool which contains member disks of a RAID Virtual disk and StorageVolume based on the StoragePool. But according to SMI-S, there is a possibility where StoragePool is created but StorageVolume is not yet created. To satisfy this scenario, we are trying a hidden RAID Virtual disk. The hidden RAID virtual disk will not be exposed to OS. Once a StorageVolume is created for this RAID virtual disk it is exposed. Signed-off-by: Anil Ravindranath Signed-off-by: James Bottomley

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial

2009-12-10T03:43:33Z

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial: (42 commits) tree-wide: fix misspelling of "definition" in comments reiserfs: fix misspelling of "journaled" doc: Fix a typo in slub.txt. inotify: remove superfluous return code check hdlc: spelling fix in find_pvc() comment doc: fix regulator docs cut-and-pasteism mtd: Fix comment in Kconfig doc: Fix IRQ chip docs tree-wide: fix assorted typos all over the place drivers/ata/libata-sff.c: comment spelling fixes fix typos/grammos in Documentation/edac.txt sysctl: add missing comments fs/debugfs/inode.c: fix comment typos sgivwfb: Make use of ARRAY_SIZE. sky2: fix sky2_link_down copy/paste comment error tree-wide: fix typos "couter" -> "counter" tree-wide: fix typos "offest" -> "offset" fix kerneldoc for set_irq_msi() spidev: fix double "of of" in comment comment typo fix: sybsystem -> subsystem ...

Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6

2009-12-10T03:42:25Z

* git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6: (222 commits) [SCSI] zfcp: Remove flag ZFCP_STATUS_FSFREQ_TMFUNCNOTSUPP [SCSI] zfcp: Activate fc4s attributes for zfcp in FC transport class [SCSI] zfcp: Block scsi_eh thread for rport state BLOCKED [SCSI] zfcp: Update FSF error reporting [SCSI] zfcp: Improve ELS ADISC handling [SCSI] zfcp: Simplify handling of ct and els requests [SCSI] zfcp: Remove ZFCP_DID_MASK [SCSI] zfcp: Move WKA port to zfcp FC code [SCSI] zfcp: Use common code definitions for FC CT structs [SCSI] zfcp: Use common code definitions for FC ELS structs [SCSI] zfcp: Update FCP protocol related code [SCSI] zfcp: Dont fail SCSI commands when transitioning to blocked fc_rport [SCSI] zfcp: Assign scheduled work to driver queue [SCSI] zfcp: Remove STATUS_COMMON_REMOVE flag as it is not required anymore [SCSI] zfcp: Implement module unloading [SCSI] zfcp: Merge trace code for fsf requests in one function [SCSI] zfcp: Access ports and units with container_of in sysfs code [SCSI] zfcp: Remove suspend callback [SCSI] zfcp: Remove global config_mutex [SCSI] zfcp: Replace local reference counting with common kref ...

Merge branch 'for-next' into for-linus

2009-12-07T17:36:35Z

Conflicts: kernel/irq/chip.c

[SCSI] modify change_queue_depth to take in reason why it is being called

2009-12-04T18:00:41Z

This patch modifies scsi_host_template->change_queue_depth so that it takes an argument indicating why it is being called. This will be used so that if a LLD needs to do some extra processing when handling queue fulls or later ramp ups, it can do so. This is a simple port of the drivers setting a change_queue_depth callback. In the patch I just have these LLDs adjust the queue depth if the user was requesting it. Signed-off-by: Mike Christie [Vasu.Dev: v2 Also converted pmcraid_change_queue_depth and then verified all modules compile using "make allmodconfig" for any new build warnings on X86_64. Updated original description after combing two original patches from Mike to make this patch git bisectable.] Signed-off-by: Vasu Dev [jejb: fixed up 53c700] Signed-off-by: James Bottomley

tree-wide: fix assorted typos all over the place

2009-12-04T14:39:55Z

That is "success", "unknown", "through", "performance", "[re|un]mapping" , "access", "default", "reasonable", "[con]currently", "temperature" , "channel", "[un]used", "application", "example","hierarchy", "therefore" , "[over|under]flow", "contiguous", "threshold", "enough" and others. Signed-off-by: André Goddard Rosa Signed-off-by: Jiri Kosina

[SCSI] pmcraid: Fix ppc64 driver build for using cpu_to_le32 on U8 data type

2009-11-06T17:09:28Z

Fix a reported ppc64 driver build issue. Removed cpu_to_le32 conversion usage for flags in struct pmcraid_ioadl_desc. This was breaking the driver build in ppc64. drivers/scsi/pmcraid.c: In function 'pmcraid_request_sense': drivers/scsi/pmcraid.c:2254: warning: large integer implicitly truncated to unsigned type Signed-off-by: Anil Ravindranath Signed-off-by: James Bottomley