mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-01 14:44:12 +00:00
scsi: megaraid_mm: Fix end of loop tests for list_for_each_entry()
The list_for_each_entry() iterator, "adapter" in this code, can never be NULL. If we exit the loop without finding the correct adapter then "adapter" points invalid memory that is an offset from the list head. This will eventually lead to memory corruption and presumably a kernel crash. Link: https://lore.kernel.org/r/20210708074642.23599-1-harshvardhan.jha@oracle.com Acked-by: Sumit Saxena <sumit.saxena@broadcom.com> Signed-off-by: Harshvardhan Jha <harshvardhan.jha@oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
This commit is contained in:
parent
d712d3fb48
commit
77541f78ea
1 changed files with 15 additions and 6 deletions
|
@ -238,7 +238,7 @@ mraid_mm_get_adapter(mimd_t __user *umimd, int *rval)
|
||||||
mimd_t mimd;
|
mimd_t mimd;
|
||||||
uint32_t adapno;
|
uint32_t adapno;
|
||||||
int iterator;
|
int iterator;
|
||||||
|
bool is_found;
|
||||||
|
|
||||||
if (copy_from_user(&mimd, umimd, sizeof(mimd_t))) {
|
if (copy_from_user(&mimd, umimd, sizeof(mimd_t))) {
|
||||||
*rval = -EFAULT;
|
*rval = -EFAULT;
|
||||||
|
@ -254,12 +254,16 @@ mraid_mm_get_adapter(mimd_t __user *umimd, int *rval)
|
||||||
|
|
||||||
adapter = NULL;
|
adapter = NULL;
|
||||||
iterator = 0;
|
iterator = 0;
|
||||||
|
is_found = false;
|
||||||
|
|
||||||
list_for_each_entry(adapter, &adapters_list_g, list) {
|
list_for_each_entry(adapter, &adapters_list_g, list) {
|
||||||
if (iterator++ == adapno) break;
|
if (iterator++ == adapno) {
|
||||||
|
is_found = true;
|
||||||
|
break;
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
if (!adapter) {
|
if (!is_found) {
|
||||||
*rval = -ENODEV;
|
*rval = -ENODEV;
|
||||||
return NULL;
|
return NULL;
|
||||||
}
|
}
|
||||||
|
@ -725,6 +729,7 @@ ioctl_done(uioc_t *kioc)
|
||||||
uint32_t adapno;
|
uint32_t adapno;
|
||||||
int iterator;
|
int iterator;
|
||||||
mraid_mmadp_t* adapter;
|
mraid_mmadp_t* adapter;
|
||||||
|
bool is_found;
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* When the kioc returns from driver, make sure it still doesn't
|
* When the kioc returns from driver, make sure it still doesn't
|
||||||
|
@ -747,19 +752,23 @@ ioctl_done(uioc_t *kioc)
|
||||||
iterator = 0;
|
iterator = 0;
|
||||||
adapter = NULL;
|
adapter = NULL;
|
||||||
adapno = kioc->adapno;
|
adapno = kioc->adapno;
|
||||||
|
is_found = false;
|
||||||
|
|
||||||
con_log(CL_ANN, ( KERN_WARNING "megaraid cmm: completed "
|
con_log(CL_ANN, ( KERN_WARNING "megaraid cmm: completed "
|
||||||
"ioctl that was timedout before\n"));
|
"ioctl that was timedout before\n"));
|
||||||
|
|
||||||
list_for_each_entry(adapter, &adapters_list_g, list) {
|
list_for_each_entry(adapter, &adapters_list_g, list) {
|
||||||
if (iterator++ == adapno) break;
|
if (iterator++ == adapno) {
|
||||||
|
is_found = true;
|
||||||
|
break;
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
kioc->timedout = 0;
|
kioc->timedout = 0;
|
||||||
|
|
||||||
if (adapter) {
|
if (is_found)
|
||||||
mraid_mm_dealloc_kioc( adapter, kioc );
|
mraid_mm_dealloc_kioc( adapter, kioc );
|
||||||
}
|
|
||||||
}
|
}
|
||||||
else {
|
else {
|
||||||
wake_up(&wait_q);
|
wake_up(&wait_q);
|
||||||
|
|
Loading…
Reference in a new issue