From patchwork Thu Jun 30 15:32:36 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Chris Leech X-Patchwork-Id: 9208435 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id E8E6D6075F for ; Thu, 30 Jun 2016 15:32:44 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id DA4732868D for ; Thu, 30 Jun 2016 15:32:44 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id CF08A28690; Thu, 30 Jun 2016 15:32:44 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 765F228692 for ; Thu, 30 Jun 2016 15:32:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932488AbcF3Pcm (ORCPT ); Thu, 30 Jun 2016 11:32:42 -0400 Received: from mx1.redhat.com ([209.132.183.28]:50722 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932261AbcF3Pck (ORCPT ); Thu, 30 Jun 2016 11:32:40 -0400 Received: from int-mx10.intmail.prod.int.phx2.redhat.com (int-mx10.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 46426935D8; Thu, 30 Jun 2016 15:32:40 +0000 (UTC) Received: from straylight.hirudinean.org.com (ovpn-116-128.phx2.redhat.com [10.3.116.128]) by int-mx10.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id u5UFWdfV018100; Thu, 30 Jun 2016 11:32:39 -0400 From: Chris Leech To: Johannes Thumshirn Cc: fcoe-devel@open-fcoe.org, linux-scsi@vger.kernel.org, Vasu Dev Subject: [PATCH v2] libfc: sanity check cpu number extracted from xid Date: Thu, 30 Jun 2016 08:32:36 -0700 Message-Id: <1467300756-7949-1-git-send-email-cleech@redhat.com> In-Reply-To: <20160630070925.ptbgkeq57txs55gf@c203.arch.suse.de> References: <20160630070925.ptbgkeq57txs55gf@c203.arch.suse.de> X-Scanned-By: MIMEDefang 2.68 on 10.5.11.23 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.26]); Thu, 30 Jun 2016 15:32:40 +0000 (UTC) Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP In the receive path libfc extracts a cpu number from the ox_id in the fiber channel header and uses that to do a per_cpu_ptr conversion. If, for some reason, a frame is received with an invalid ox_id, per_cpu_ptr will return an invalid pointer and the libfc receive path will panic the system trying to use it. I'm currently looking at such a case, and I don't yet know why a cpu number > nr_cpu_ids is appearing in an exchange id. But adding a sanity check in libfc prevents a system panic, and seems like good idea when dealing with frames coming in from the network. Signed-off-by: Chris Leech Acked-by: Johannes Thumshirn --- drivers/scsi/libfc/fc_exch.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c index 30f9ef0..e72673b 100644 --- a/drivers/scsi/libfc/fc_exch.c +++ b/drivers/scsi/libfc/fc_exch.c @@ -908,9 +908,17 @@ static struct fc_exch *fc_exch_find(struct fc_exch_mgr *mp, u16 xid) { struct fc_exch_pool *pool; struct fc_exch *ep = NULL; + u16 cpu = xid & fc_cpu_mask; + + if (cpu >= nr_cpu_ids || !cpu_possible(cpu)) { + printk_ratelimited(KERN_ERR + "libfc: lookup request for XID = %d, " + "indicates invalid CPU %d\n", xid, cpu); + return NULL; + } if ((xid >= mp->min_xid) && (xid <= mp->max_xid)) { - pool = per_cpu_ptr(mp->pool, xid & fc_cpu_mask); + pool = per_cpu_ptr(mp->pool, cpu); spin_lock_bh(&pool->lock); ep = fc_exch_ptr_get(pool, (xid - mp->min_xid) >> fc_cpu_order); if (ep) {