Home Home > GIT Browse > stable
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJiri Slaby <jslaby@suse.cz>2019-08-16 22:01:45 +0200
committerJiri Slaby <jslaby@suse.cz>2019-08-16 22:25:10 +0200
commit16672755ce04d2a0cdb0fb42c985f0dc18439410 (patch)
tree8e803458955adb2e17a5b146346205637b0cb332
parent7e2a0086df822c06a482fda3184e62459c7e764d (diff)
scsi: megaraid_sas: fix panic on loading firmware crashdump
-rw-r--r--patches.kernel.org/5.2.9-107-scsi-megaraid_sas-fix-panic-on-loading-firmware.patch46
-rw-r--r--series.conf1
2 files changed, 47 insertions, 0 deletions
diff --git a/patches.kernel.org/5.2.9-107-scsi-megaraid_sas-fix-panic-on-loading-firmware.patch b/patches.kernel.org/5.2.9-107-scsi-megaraid_sas-fix-panic-on-loading-firmware.patch
new file mode 100644
index 0000000000..4e4174b1f6
--- /dev/null
+++ b/patches.kernel.org/5.2.9-107-scsi-megaraid_sas-fix-panic-on-loading-firmware.patch
@@ -0,0 +1,46 @@
+From: Junxiao Bi <junxiao.bi@oracle.com>
+Date: Mon, 22 Jul 2019 09:15:24 -0700
+Subject: [PATCH] scsi: megaraid_sas: fix panic on loading firmware crashdump
+References: bnc#1012628
+Patch-mainline: 5.2.9
+Git-commit: 3b5f307ef3cb5022bfe3c8ca5b8f2114d5bf6c29
+
+[ Upstream commit 3b5f307ef3cb5022bfe3c8ca5b8f2114d5bf6c29 ]
+
+While loading fw crashdump in function fw_crash_buffer_show(), left bytes
+in one dma chunk was not checked, if copying size over it, overflow access
+will cause kernel panic.
+
+Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
+Acked-by: Sumit Saxena <sumit.saxena@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/scsi/megaraid/megaraid_sas_base.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index 7237114a1d53..5f30016e9b64 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -3045,6 +3045,7 @@ megasas_fw_crash_buffer_show(struct device *cdev,
+ u32 size;
+ unsigned long buff_addr;
+ unsigned long dmachunk = CRASH_DMA_BUF_SIZE;
++ unsigned long chunk_left_bytes;
+ unsigned long src_addr;
+ unsigned long flags;
+ u32 buff_offset;
+@@ -3070,6 +3071,8 @@ megasas_fw_crash_buffer_show(struct device *cdev,
+ }
+
+ size = (instance->fw_crash_buffer_size * dmachunk) - buff_offset;
++ chunk_left_bytes = dmachunk - (buff_offset % dmachunk);
++ size = (size > chunk_left_bytes) ? chunk_left_bytes : size;
+ size = (size >= PAGE_SIZE) ? (PAGE_SIZE - 1) : size;
+
+ src_addr = (unsigned long)instance->crash_buf[buff_offset / dmachunk] +
+--
+2.22.0
+
diff --git a/series.conf b/series.conf
index 4e85ed0ed2..5e392a2575 100644
--- a/series.conf
+++ b/series.conf
@@ -1127,6 +1127,7 @@
patches.kernel.org/5.2.9-104-nvme-fix-memory-leak-caused-by-incorrect-subsys.patch
patches.kernel.org/5.2.9-105-ARM-davinci-fix-sleep.S-build-error-on-ARMv4.patch
patches.kernel.org/5.2.9-106-ARM-dts-bcm-bcm47094-add-missing-cells-for-mdio.patch
+ patches.kernel.org/5.2.9-107-scsi-megaraid_sas-fix-panic-on-loading-firmware.patch
########################################################
# Build fixes that apply to the vanilla kernel too.