[SCSI] eliminate potential kmalloc failure in scsi_get_vpd_page()

The best way to fix this is to eliminate the intenal kmalloc() and
make the caller allocate the required amount of storage.

Signed-off-by: James Bottomley <James.Bottomley@suse.de>

diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index a60da55555778822a3d96a5571646c865775f9ea..513661f45e5f23e69c2e0d8c6f5deb963365dff7 100644 (file)
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -1026,55 +1026,39 @@ static int scsi_vpd_inquiry(struct scsi_device *sdev, unsigned char *buffer,
  * responsible for calling kfree() on this pointer when it is no longer
  * needed.  If we cannot retrieve the VPD page this routine returns %NULL.
  */
-unsigned char *scsi_get_vpd_page(struct scsi_device *sdev, u8 page)
+int scsi_get_vpd_page(struct scsi_device *sdev, u8 page, unsigned char *buf,
+                     int buf_len)
 {
        int i, result;
-       unsigned int len;
-       const unsigned int init_vpd_len = 255;
-       unsigned char *buf = kmalloc(init_vpd_len, GFP_KERNEL);
-
-       if (!buf)
-               return NULL;
 
        /* Ask for all the pages supported by this device */
-       result = scsi_vpd_inquiry(sdev, buf, 0, init_vpd_len);
+       result = scsi_vpd_inquiry(sdev, buf, 0, buf_len);
        if (result)
                goto fail;
 
        /* If the user actually wanted this page, we can skip the rest */
        if (page == 0)
-               return buf;
+               return -EINVAL;
 
-       for (i = 0; i < buf[3]; i++)
+       for (i = 0; i < min((int)buf[3], buf_len - 4); i++)
                if (buf[i + 4] == page)
                        goto found;
+
+       if (i < buf[3] && i > buf_len)
+               /* ran off the end of the buffer, give us benefit of doubt */
+               goto found;
        /* The device claims it doesn't support the requested page */
        goto fail;
 
  found:
-       result = scsi_vpd_inquiry(sdev, buf, page, 255);
+       result = scsi_vpd_inquiry(sdev, buf, page, buf_len);
        if (result)
                goto fail;
 
-       /*
-        * Some pages are longer than 255 bytes.  The actual length of
-        * the page is returned in the header.
-        */
-       len = ((buf[2] << 8) | buf[3]) + 4;
-       if (len <= init_vpd_len)
-               return buf;
-
-       kfree(buf);
-       buf = kmalloc(len, GFP_KERNEL);
-       result = scsi_vpd_inquiry(sdev, buf, page, len);
-       if (result)
-               goto fail;
-
-       return buf;
+       return 0;
 
  fail:
-       kfree(buf);
-       return NULL;
+       return -EINVAL;
 }
 EXPORT_SYMBOL_GPL(scsi_get_vpd_page);
 

diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 255da53e5a01a1dd970fac95b2106888b6e91c6b..c5e9a99d4066921cae4bac7b3fa7a3b8114beb46 100644 (file)
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1946,13 +1946,13 @@ static void sd_read_block_limits(struct scsi_disk *sdkp)
 {
        struct request_queue *q = sdkp->disk->queue;
        unsigned int sector_sz = sdkp->device->sector_size;
-       char *buffer;
+       const int vpd_len = 32;
+       unsigned char *buffer = kmalloc(vpd_len, GFP_KERNEL);
 
-       /* Block Limits VPD */
-       buffer = scsi_get_vpd_page(sdkp->device, 0xb0);
-
-       if (buffer == NULL)
-               return;
+       if (!buffer ||
+           /* Block Limits VPD */
+           scsi_get_vpd_page(sdkp->device, 0xb0, buffer, vpd_len))
+               goto out;
 
        blk_queue_io_min(sdkp->disk->queue,
                         get_unaligned_be16(&buffer[6]) * sector_sz);
@@ -1984,6 +1984,7 @@ static void sd_read_block_limits(struct scsi_disk *sdkp)
                                get_unaligned_be32(&buffer[32]) & ~(1 << 31);
        }
 
+ out:
        kfree(buffer);
 }
 
@@ -1993,20 +1994,23 @@ static void sd_read_block_limits(struct scsi_disk *sdkp)
  */
 static void sd_read_block_characteristics(struct scsi_disk *sdkp)
 {
-       char *buffer;
+       unsigned char *buffer;
        u16 rot;
+       const int vpd_len = 32;
 
-       /* Block Device Characteristics VPD */
-       buffer = scsi_get_vpd_page(sdkp->device, 0xb1);
+       buffer = kmalloc(vpd_len, GFP_KERNEL);
 
-       if (buffer == NULL)
-               return;
+       if (!buffer ||
+           /* Block Device Characteristics VPD */
+           scsi_get_vpd_page(sdkp->device, 0xb1, buffer, vpd_len))
+               goto out;
 
        rot = get_unaligned_be16(&buffer[4]);
 
        if (rot == 1)
                queue_flag_set_unlocked(QUEUE_FLAG_NONROT, sdkp->disk->queue);
 
+ out:
        kfree(buffer);
 }
 

diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
index 55b034b72708e5f8b5cc873082e3a44003325ba7..1d7a8780e00cda01248a1854fe1e77c88c7f6d67 100644 (file)
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -448,13 +448,17 @@ static void ses_match_to_enclosure(struct enclosure_device *edev,
                .addr = 0,
        };
 
-       buf = scsi_get_vpd_page(sdev, 0x83);
-       if (!buf)
-               return;
+       buf = kmalloc(INIT_ALLOC_SIZE, GFP_KERNEL);
+       if (!buf || scsi_get_vpd_page(sdev, 0x83, buf, INIT_ALLOC_SIZE))
+               goto free;
 
        ses_enclosure_data_process(edev, to_scsi_device(edev->edev.parent), 0);
 
        vpd_len = ((buf[2] << 8) | buf[3]) + 4;
+       kfree(buf);
+       buf = kmalloc(vpd_len, GFP_KERNEL);
+       if (!buf ||scsi_get_vpd_page(sdev, 0x83, buf, vpd_len))
+               goto free;
 
        desc = buf + 4;
        while (desc < buf + vpd_len) {

diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
index 7c4449900c24510b60eb40d1f1e27d329db4795f..d80b6dbed1cac2a34c2cf7655590cd1473a9e378 100644 (file)
--- a/include/scsi/scsi_device.h
+++ b/include/scsi/scsi_device.h
@@ -348,7 +348,8 @@ extern int scsi_mode_select(struct scsi_device *sdev, int pf, int sp,
                            struct scsi_sense_hdr *);
 extern int scsi_test_unit_ready(struct scsi_device *sdev, int timeout,
                                int retries, struct scsi_sense_hdr *sshdr);
-extern unsigned char *scsi_get_vpd_page(struct scsi_device *, u8 page);
+extern int scsi_get_vpd_page(struct scsi_device *, u8 page, unsigned char *buf,
+                            int buf_len);
 extern int scsi_device_set_state(struct scsi_device *sdev,
                                 enum scsi_device_state state);
 extern struct scsi_event *sdev_evt_alloc(enum scsi_device_event evt_type,