]> git.karo-electronics.de Git - karo-tx-linux.git/commit
SCSI: mpt2sas: Fix for panic happening because of improper memory allocation
authornagalakshmi.nandigama@lsi.com <nagalakshmi.nandigama@lsi.com>
Tue, 20 Mar 2012 06:40:01 +0000 (12:10 +0530)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 1 Jun 2012 07:18:15 +0000 (15:18 +0800)
commit3102e700882480237273c4e45a65f23fce0dd345
tree4ae1400c74dfee41454ee9caef7db209235b9f78
parentafde0dae8ee521686465141a44aa8060f4805cab
SCSI: mpt2sas: Fix for panic happening because of improper memory allocation

commit e42fafc25fa86c61824e8d4c5e7582316415d24f upstream.

The ioc->pfacts member in the IOC structure is getting set to zero
following a call to _base_get_ioc_facts due to the memset in that routine.
So if the ioc->pfacts was read after a host reset, there would be a NULL
pointer dereference. The routine _base_get_ioc_facts is called from context
of host reset.  The problem in _base_get_ioc_facts  is the size of
Mpi2IOCFactsReply is 64, whereas the sizeof "struct mpt2sas_facts" is 60,
so there is a four byte overflow resulting from the memset.

Also, there is memset in _base_get_port_facts using the incorrect structure,
it should be "struct mpt2sas_port_facts" instead of Mpi2PortFactsReply.

Signed-off-by: Nagalakshmi Nandigama <nagalakshmi.nandigama@lsi.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/scsi/mpt2sas/mpt2sas_base.c