From: Jayamohan Kallickal Date: Tue, 6 May 2014 01:41:28 +0000 (-0400) Subject: be2iscsi: Fix memory corruption in MBX path X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=8fc01eaa8793b7c2277b4a84c218a5f8fe45ccdd;p=linux-beck.git be2iscsi: Fix memory corruption in MBX path From: Dan Carpenter [mailto:dan.carpenter@oracle.com] Sent: Friday, March 28, 2014 1:42 AM Subject: re: [SCSI] be2iscsi: Fix handling timed out MBX completion from FW Hello Jayamohan Kallickal, The patch 1957aa7f6246: "[SCSI] be2iscsi: Fix handling timed out MBX completion from FW" from Jan 29, 2014, leads to the following static checker warning: drivers/scsi/be2iscsi/be_main.c:5581 beiscsi_dev_probe() error: memset() '&phba->ctrl.ptag_state[i]->tag_mem_state' too small (24 vs 32) drivers/scsi/be2iscsi/be_main.c 5576 for (i = 0; i < MAX_MCC_CMD; i++) { 5577 init_waitqueue_head(&phba->ctrl.mcc_wait[i + 1]); 5578 phba->ctrl.mcc_tag[i] = i + 1; 5579 phba->ctrl.mcc_numtag[i + 1] = 0; 5580 phba->ctrl.mcc_tag_available++; 5581 memset(&phba->ctrl.ptag_state[i].tag_mem_state, 0, 5582 sizeof(struct beiscsi_mcc_tag_state)); ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Probably this this be change to sizeof(struct be_dma_mem struct)? It looks like we are corrupting memory a bit here. 5583 } regards, dan carpenter Reported-by: Dan Carpenter Signed-off-by: John Soni Jose Signed-off-by: Jayamohan Kallickal Signed-off-by: Christoph Hellwig --- diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c index e9f01a5f360b..e202ab32d13e 100644 --- a/drivers/scsi/be2iscsi/be_main.c +++ b/drivers/scsi/be2iscsi/be_main.c @@ -5625,7 +5625,7 @@ static int beiscsi_dev_probe(struct pci_dev *pcidev, phba->ctrl.mcc_numtag[i + 1] = 0; phba->ctrl.mcc_tag_available++; memset(&phba->ctrl.ptag_state[i].tag_mem_state, 0, - sizeof(struct beiscsi_mcc_tag_state)); + sizeof(struct be_dma_mem)); } phba->ctrl.mcc_alloc_index = phba->ctrl.mcc_free_index = 0;