diff mbox

[2/2] megaraid_sas: Fix SMAP issue

Message ID 1453995866-25097-3-git-send-email-sumit.saxena@avagotech.com (mailing list archive)
State Accepted, archived
Headers show

Commit Message

Sumit Saxena Jan. 28, 2016, 3:44 p.m. UTC 
Inside compat IOCTL hook of driver, driver was using wrong address of
ioc->frame.raw which leads sense_ioc_ptr to be calculated wrongly and
failing IOCTL.

Signed-off-by: Sumit Saxena <sumit.saxena@avagotech.com>
---
 drivers/scsi/megaraid/megaraid_sas_base.c | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

Comments

Tomas Henzl Jan. 29, 2016, 4:24 p.m. UTC | #1 
On 28.1.2016 16:44, Sumit Saxena wrote:
> Inside compat IOCTL hook of driver, driver was using wrong address of
> ioc->frame.raw which leads sense_ioc_ptr to be calculated wrongly and
> failing IOCTL.
>
> Signed-off-by: Sumit Saxena <sumit.saxena@avagotech.com>

Reviewed-by: Tomas Henzl <thenzl@redhat.com>

Tomas

--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Martin K. Petersen Feb. 10, 2016, 1:49 a.m. UTC | #2 
>>>>> "Sumit" == Sumit Saxena <sumit.saxena@avagotech.com> writes:

Sumit> Inside compat IOCTL hook of driver, driver was using wrong
Sumit> address of ioc-> frame.raw which leads sense_ioc_ptr to be
Sumit> calculated wrongly and failing IOCTL.

Applied to 4.6/scsi-queue.
diff mbox

Patch

diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index 52f3419..cc92c81 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -6843,9 +6843,9 @@  static int megasas_mgmt_compat_ioctl_fw(struct file *file, unsigned long arg)
 	int i;
 	int error = 0;
 	compat_uptr_t ptr;
-	unsigned long local_raw_ptr;
 	u32 local_sense_off;
 	u32 local_sense_len;
+	u32 user_sense_off;
 
 	if (clear_user(ioc, sizeof(*ioc)))
 		return -EFAULT;
@@ -6863,17 +6863,16 @@  static int megasas_mgmt_compat_ioctl_fw(struct file *file, unsigned long arg)
 	 * sense_len is not null, so prepare the 64bit value under
 	 * the same condition.
 	 */
-	if (get_user(local_raw_ptr, ioc->frame.raw) ||
-		get_user(local_sense_off, &ioc->sense_off) ||
-		get_user(local_sense_len, &ioc->sense_len))
+	if (get_user(local_sense_off, &ioc->sense_off) ||
+		get_user(local_sense_len, &ioc->sense_len) ||
+		get_user(user_sense_off, &cioc->sense_off))
 		return -EFAULT;
 
-
 	if (local_sense_len) {
 		void __user **sense_ioc_ptr =
-			(void __user **)((u8*)local_raw_ptr + local_sense_off);
+			(void __user **)((u8 *)((unsigned long)&ioc->frame.raw) + local_sense_off);
 		compat_uptr_t *sense_cioc_ptr =
-			(compat_uptr_t *)(cioc->frame.raw + cioc->sense_off);
+			(compat_uptr_t *)(((unsigned long)&cioc->frame.raw) + user_sense_off);
 		if (get_user(ptr, sense_cioc_ptr) ||
 		    put_user(compat_ptr(ptr), sense_ioc_ptr))
 			return -EFAULT;