[PATCH 5/8] be2iscsi: Fix memory corruption in MBX path

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



From: Jayamohan Kallickal <jayamohan.kallickal@xxxxxxxxxx>

 From: Dan Carpenter [mailto:dan.carpenter@xxxxxxxxxx]
 Sent: Friday, March 28, 2014 1:42 AM
 Subject: re: [SCSI] be2iscsi: Fix handling timed out MBX completion from FW

 Hello Jayamohan Kallickal,

 The patch 1957aa7f6246: "[SCSI] be2iscsi: Fix handling timed out MBX completion from FW" from Jan 29, 2014, leads to the following static checker warning:

 drivers/scsi/be2iscsi/be_main.c:5581 beiscsi_dev_probe()
 error: memset() '&phba->ctrl.ptag_state[i]->tag_mem_state' too small (24 vs 32)

 drivers/scsi/be2iscsi/be_main.c
 5576          for (i = 0; i < MAX_MCC_CMD; i++) {
 5577                  init_waitqueue_head(&phba->ctrl.mcc_wait[i + 1]);
 5578                  phba->ctrl.mcc_tag[i] = i + 1;
 5579                  phba->ctrl.mcc_numtag[i + 1] = 0;
 5580                  phba->ctrl.mcc_tag_available++;
 5581                  memset(&phba->ctrl.ptag_state[i].tag_mem_state, 0,
 5582                         sizeof(struct beiscsi_mcc_tag_state));
                               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 Probably this this be change to sizeof(struct be_dma_mem struct)?  It looks like we are corrupting memory a bit here.

 5583          }

 regards,
 dan carpenter

Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Signed-off-by: John Soni Jose <sony.john-n@xxxxxxxxxx>
Signed-off-by: Jayamohan Kallickal <jayamohan.kallickal@xxxxxxxxxx>
---
 drivers/scsi/be2iscsi/be_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
index 9ff8667..e8bba90 100644
--- a/drivers/scsi/be2iscsi/be_main.c
+++ b/drivers/scsi/be2iscsi/be_main.c
@@ -5625,7 +5625,7 @@ static int beiscsi_dev_probe(struct pci_dev *pcidev,
 		phba->ctrl.mcc_numtag[i + 1] = 0;
 		phba->ctrl.mcc_tag_available++;
 		memset(&phba->ctrl.ptag_state[i].tag_mem_state, 0,
-		       sizeof(struct beiscsi_mcc_tag_state));
+		       sizeof(struct be_dma_mem));
 	}
 
 	phba->ctrl.mcc_alloc_index = phba->ctrl.mcc_free_index = 0;
-- 
1.8.5.3

--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [SCSI Target Devel]     [Linux SCSI Target Infrastructure]     [Kernel Newbies]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Linux IIO]     [Samba]     [Device Mapper]
  Powered by Linux