Home Home > GIT Browse > SLE12-SP5-AZURE
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2019-08-21 07:28:37 +0200
committerTakashi Iwai <tiwai@suse.de>2019-08-21 07:28:37 +0200
commit1043afa8ec7f9a057930061a64fdbe2ec6d5f65f (patch)
treebe437c1b6838ad910aaecc786d60927dcd81cd7e
parent3b35ec5faed5dd6dee060797bbf70864b4431f4c (diff)
parent61748923f039fa1489e5baa04c89e29226a346ca (diff)
Merge branch 'users/lduncan/SLE15/for-next' into SLE15
Pull scsi fix from Lee Duncan
-rw-r--r--patches.fixes/scsi-qedi-remove-memset-memcpy-to-nfunc-and-use-func-instead165
-rw-r--r--series.conf1
2 files changed, 166 insertions, 0 deletions
diff --git a/patches.fixes/scsi-qedi-remove-memset-memcpy-to-nfunc-and-use-func-instead b/patches.fixes/scsi-qedi-remove-memset-memcpy-to-nfunc-and-use-func-instead
new file mode 100644
index 0000000000..eaa79529e9
--- /dev/null
+++ b/patches.fixes/scsi-qedi-remove-memset-memcpy-to-nfunc-and-use-func-instead
@@ -0,0 +1,165 @@
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Sat, 20 Apr 2019 12:05:54 +0800
+Subject: scsi: qedi: remove memset/memcpy to nfunc and use func instead
+Git-commit: c09581a52765a85f19fc35340127396d5e3379cc
+Patch-mainline: v5.2-rc2
+References: bsc#1146399 CVE-2019-15090
+
+KASAN reports this:
+
+BUG: KASAN: global-out-of-bounds in qedi_dbg_err+0xda/0x330 [qedi]
+Read of size 31 at addr ffffffffc12b0ae0 by task syz-executor.0/2429
+
+CPU: 0 PID: 2429 Comm: syz-executor.0 Not tainted 5.0.0-rc7+ #45
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
+Call Trace:
+ __dump_stack lib/dump_stack.c:77 [inline]
+ dump_stack+0xfa/0x1ce lib/dump_stack.c:113
+ print_address_description+0x1c4/0x270 mm/kasan/report.c:187
+ kasan_report+0x149/0x18d mm/kasan/report.c:317
+ memcpy+0x1f/0x50 mm/kasan/common.c:130
+ qedi_dbg_err+0xda/0x330 [qedi]
+ ? 0xffffffffc12d0000
+ qedi_init+0x118/0x1000 [qedi]
+ ? 0xffffffffc12d0000
+ ? 0xffffffffc12d0000
+ ? 0xffffffffc12d0000
+ do_one_initcall+0xfa/0x5ca init/main.c:887
+ do_init_module+0x204/0x5f6 kernel/module.c:3460
+ load_module+0x66b2/0x8570 kernel/module.c:3808
+ __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902
+ do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+RIP: 0033:0x462e99
+Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
+RSP: 002b:00007f2d57e55c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
+RAX: ffffffffffffffda RBX: 000000000073bfa0 RCX: 0000000000462e99
+RDX: 0000000000000000 RSI: 00000000200003c0 RDI: 0000000000000003
+RBP: 00007f2d57e55c70 R08: 0000000000000000 R09: 0000000000000000
+R10: 0000000000000000 R11: 0000000000000246 R12: 00007f2d57e566bc
+R13: 00000000004bcefb R14: 00000000006f7030 R15: 0000000000000004
+
+The buggy address belongs to the variable:
+ __func__.67584+0x0/0xffffffffffffd520 [qedi]
+
+Memory state around the buggy address:
+ ffffffffc12b0980: fa fa fa fa 00 04 fa fa fa fa fa fa 00 00 05 fa
+ ffffffffc12b0a00: fa fa fa fa 00 00 04 fa fa fa fa fa 00 05 fa fa
+> ffffffffc12b0a80: fa fa fa fa 00 06 fa fa fa fa fa fa 00 02 fa fa
+ ^
+ ffffffffc12b0b00: fa fa fa fa 00 00 04 fa fa fa fa fa 00 00 03 fa
+ ffffffffc12b0b80: fa fa fa fa 00 00 02 fa fa fa fa fa 00 00 04 fa
+
+Currently the qedi_dbg_* family of functions can overrun the end of the
+source string if it is less than the destination buffer length because of
+the use of a fixed sized memcpy. Remove the memset/memcpy calls to nfunc
+and just use func instead as it is always a null terminated string.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: ace7f46ba5fd ("scsi: qedi: Add QLogic FastLinQ offload iSCSI driver framework.")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Lee Duncan <lduncan@suse.com>
+---
+ drivers/scsi/qedi/qedi_dbg.c | 32 ++++++++------------------------
+ 1 file changed, 8 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/scsi/qedi/qedi_dbg.c b/drivers/scsi/qedi/qedi_dbg.c
+index 8fd28b056f73..3383314a3882 100644
+--- a/drivers/scsi/qedi/qedi_dbg.c
++++ b/drivers/scsi/qedi/qedi_dbg.c
+@@ -16,10 +16,6 @@ qedi_dbg_err(struct qedi_dbg_ctx *qedi, const char *func, u32 line,
+ {
+ va_list va;
+ struct va_format vaf;
+- char nfunc[32];
+-
+- memset(nfunc, 0, sizeof(nfunc));
+- memcpy(nfunc, func, sizeof(nfunc) - 1);
+
+ va_start(va, fmt);
+
+@@ -28,9 +24,9 @@ qedi_dbg_err(struct qedi_dbg_ctx *qedi, const char *func, u32 line,
+
+ if (likely(qedi) && likely(qedi->pdev))
+ pr_err("[%s]:[%s:%d]:%d: %pV", dev_name(&qedi->pdev->dev),
+- nfunc, line, qedi->host_no, &vaf);
++ func, line, qedi->host_no, &vaf);
+ else
+- pr_err("[0000:00:00.0]:[%s:%d]: %pV", nfunc, line, &vaf);
++ pr_err("[0000:00:00.0]:[%s:%d]: %pV", func, line, &vaf);
+
+ va_end(va);
+ }
+@@ -41,10 +37,6 @@ qedi_dbg_warn(struct qedi_dbg_ctx *qedi, const char *func, u32 line,
+ {
+ va_list va;
+ struct va_format vaf;
+- char nfunc[32];
+-
+- memset(nfunc, 0, sizeof(nfunc));
+- memcpy(nfunc, func, sizeof(nfunc) - 1);
+
+ va_start(va, fmt);
+
+@@ -56,9 +48,9 @@ qedi_dbg_warn(struct qedi_dbg_ctx *qedi, const char *func, u32 line,
+
+ if (likely(qedi) && likely(qedi->pdev))
+ pr_warn("[%s]:[%s:%d]:%d: %pV", dev_name(&qedi->pdev->dev),
+- nfunc, line, qedi->host_no, &vaf);
++ func, line, qedi->host_no, &vaf);
+ else
+- pr_warn("[0000:00:00.0]:[%s:%d]: %pV", nfunc, line, &vaf);
++ pr_warn("[0000:00:00.0]:[%s:%d]: %pV", func, line, &vaf);
+
+ ret:
+ va_end(va);
+@@ -70,10 +62,6 @@ qedi_dbg_notice(struct qedi_dbg_ctx *qedi, const char *func, u32 line,
+ {
+ va_list va;
+ struct va_format vaf;
+- char nfunc[32];
+-
+- memset(nfunc, 0, sizeof(nfunc));
+- memcpy(nfunc, func, sizeof(nfunc) - 1);
+
+ va_start(va, fmt);
+
+@@ -85,10 +73,10 @@ qedi_dbg_notice(struct qedi_dbg_ctx *qedi, const char *func, u32 line,
+
+ if (likely(qedi) && likely(qedi->pdev))
+ pr_notice("[%s]:[%s:%d]:%d: %pV",
+- dev_name(&qedi->pdev->dev), nfunc, line,
++ dev_name(&qedi->pdev->dev), func, line,
+ qedi->host_no, &vaf);
+ else
+- pr_notice("[0000:00:00.0]:[%s:%d]: %pV", nfunc, line, &vaf);
++ pr_notice("[0000:00:00.0]:[%s:%d]: %pV", func, line, &vaf);
+
+ ret:
+ va_end(va);
+@@ -100,10 +88,6 @@ qedi_dbg_info(struct qedi_dbg_ctx *qedi, const char *func, u32 line,
+ {
+ va_list va;
+ struct va_format vaf;
+- char nfunc[32];
+-
+- memset(nfunc, 0, sizeof(nfunc));
+- memcpy(nfunc, func, sizeof(nfunc) - 1);
+
+ va_start(va, fmt);
+
+@@ -115,9 +99,9 @@ qedi_dbg_info(struct qedi_dbg_ctx *qedi, const char *func, u32 line,
+
+ if (likely(qedi) && likely(qedi->pdev))
+ pr_info("[%s]:[%s:%d]:%d: %pV", dev_name(&qedi->pdev->dev),
+- nfunc, line, qedi->host_no, &vaf);
++ func, line, qedi->host_no, &vaf);
+ else
+- pr_info("[0000:00:00.0]:[%s:%d]: %pV", nfunc, line, &vaf);
++ pr_info("[0000:00:00.0]:[%s:%d]: %pV", func, line, &vaf);
+
+ ret:
+ va_end(va);
+
diff --git a/series.conf b/series.conf
index 4ec5ba79ca..2517773daa 100644
--- a/series.conf
+++ b/series.conf
@@ -22818,6 +22818,7 @@
patches.fixes/sbitmap-fix-improper-use-of-smp_mb__before_atomic.patch
patches.fixes/blk-mq-fix-hang-caused-by-freeze-unfreeze-sequence.patch
patches.fixes/nvme-copy-mtfa-field-from-identify-controller.patch
+ patches.fixes/scsi-qedi-remove-memset-memcpy-to-nfunc-and-use-func-instead
patches.fixes/ext4-wait-for-outstanding-dio-during-truncate-in-noj.patch
patches.fixes/ext4-do-not-delete-unlinked-inode-from-orphan-list-o.patch
patches.fixes/KVM-s390-fix-typo-in-parameter-description.patch