linux-stable.git/drivers/message/fusion, branch linux-3.16.y

scsi: mptfusion: Fix double fetch bug in ioctl

2020-06-11T18:05:41+00:00

commit 28d76df18f0ad5bcf5fa48510b225f0ed262a99b upstream.

Tom Hatskevich reported that we look up "iocp" then, in the called
functions we do a second copy_from_user() and look it up again.
The problem that could cause is:

drivers/message/fusion/mptctl.c
   674          /* All of these commands require an interrupt or
   675           * are unknown/illegal.
   676           */
   677          if ((ret = mptctl_syscall_down(iocp, nonblock)) != 0)
                                               ^^^^
We take this lock.

   678                  return ret;
   679
   680          if (cmd == MPTFWDOWNLOAD)
   681                  ret = mptctl_fw_download(arg);
                                                 ^^^
Then the user memory changes and we look up "iocp" again but a different
one so now we are holding the incorrect lock and have a race condition.

   682          else if (cmd == MPTCOMMAND)
   683                  ret = mptctl_mpt_command(arg);

The security impact of this bug is not as bad as it could have been
because these operations are all privileged and root already has
enormous destructive power.  But it's still worth fixing.

This patch passes the "iocp" pointer to the functions to avoid the
second lookup.  That deletes 100 lines of code from the driver so
it's a nice clean up as well.

Link: https://lore.kernel.org/r/20200114123414.GA7957@kadam
Reported-by: Tom Hatskevich 
Reviewed-by: Greg Kroah-Hartman 
Signed-off-by: Dan Carpenter 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Ben Hutchings

scsi: mptfusion: Add bounds check in mptctl_hp_targetinfo()

2020-06-11T18:05:41+00:00

commit a7043e9529f3c367cc4d82997e00be034cbe57ca upstream.

My static checker complains about an out of bounds read:

    drivers/message/fusion/mptctl.c:2786 mptctl_hp_targetinfo()
    error: buffer overflow 'hd->sel_timeout' 255 <= u32max.

It's true that we probably should have a bounds check here.

Signed-off-by: Dan Carpenter 
Reviewed-by: Johannes Thumshirn 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Ben Hutchings

scsi: mptsas: Disable WRITE SAME

2018-10-21T07:45:31+00:00

commit 94e5395d2403c8bc2504a7cbe4c4caaacb7b8b84 upstream.

First generation MPT Fusion controllers can not translate WRITE SAME
when the attached device is a SATA drive. Disable WRITE SAME support.

Reported-by: Nikola Ciprich 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Ben Hutchings

mptfusion: enable no_write_same for vmware scsi disks

2014-10-30T16:40:12+00:00

commit 4089b71cc820a426d601283c92fcd4ffeb5139c2 upstream.

When using a virtual SCSI disk in a VMWare VM if blkdev_issue_zeroout is used
data can be improperly zeroed out using the mptfusion driver. This patch
disables write_same for this driver and the vmware subsystem_vendor which
ensures that manual zeroing out is used instead.

BugLink: http://bugs.launchpad.net/bugs/1371591
Reported-by: Bruce Lucas 
Tested-by: Chris J Arges 
Signed-off-by: Chris J Arges 
Reviewed-by: Martin K. Petersen 
Signed-off-by: Christoph Hellwig 
Signed-off-by: Greg Kroah-Hartman

mptfusion: fix msgContext in mptctl_hp_hostinfo

2014-05-28T16:14:16+00:00

Hi,

without this patch the istwiRWRequest->MsgContext is always set to zero,
this patch saves the MsgContext in a msgcontext variable and then restores
the value.
Thanks to  David Jeffery who found the issue and did the analysis.

Signed-off-by: Tomas Henzl 
Acked-by: Desai, Kashyap 
Signed-off-by: Christoph Hellwig

fusion: Remove use of DEF_SCSI_QCMD

2014-05-28T16:13:25+00:00

Removing the host_lock from the I/O submission path gives a huge
scalability improvement.

Signed-off-by: Matthew Wilcox 
Reviewed-by: Nicholas Bellinger 
Reviewed-by: Praveen Krishnamoorthy 
Acked-by: Sreekanth Reddy 
Signed-off-by: Christoph Hellwig

fusion: Add free msg frames to the head, not tail of list

2014-05-28T16:13:24+00:00

Reusing a msg frame quickly means it's still cache-hot.  This yields
a small but noticable performance improvement in a well-known database
benchmark.  This improvement is already present in the mpt3sas driver.

Signed-off-by: Matthew Wilcox 
Reviewed-by: Nicholas Bellinger 
Reviewed-by: Praveen Krishnamoorthy 
Acked-by: Sreekanth Reddy 
Signed-off-by: Christoph Hellwig

Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block

2014-01-30T19:19:05+00:00

Pull core block IO changes from Jens Axboe:
 "The major piece in here is the immutable bio_ve series from Kent, the
  rest is fairly minor.  It was supposed to go in last round, but
  various issues pushed it to this release instead.  The pull request
  contains:

   - Various smaller blk-mq fixes from different folks.  Nothing major
     here, just minor fixes and cleanups.

   - Fix for a memory leak in the error path in the block ioctl code
     from Christian Engelmayer.

   - Header export fix from CaiZhiyong.

   - Finally the immutable biovec changes from Kent Overstreet.  This
     enables some nice future work on making arbitrarily sized bios
     possible, and splitting more efficient.  Related fixes to immutable
     bio_vecs:

        - dm-cache immutable fixup from Mike Snitzer.
        - btrfs immutable fixup from Muthu Kumar.

  - bio-integrity fix from Nic Bellinger, which is also going to stable"

* 'for-3.14/core' of git://git.kernel.dk/linux-block: (44 commits)
  xtensa: fixup simdisk driver to work with immutable bio_vecs
  block/blk-mq-cpu.c: use hotcpu_notifier()
  blk-mq: for_each_* macro correctness
  block: Fix memory leak in rw_copy_check_uvector() handling
  bio-integrity: Fix bio_integrity_verify segment start bug
  block: remove unrelated header files and export symbol
  blk-mq: uses page->list incorrectly
  blk-mq: use __smp_call_function_single directly
  btrfs: fix missing increment of bi_remaining
  Revert "block: Warn and free bio if bi_end_io is not set"
  block: Warn and free bio if bi_end_io is not set
  blk-mq: fix initializing request's start time
  block: blk-mq: don't export blk_mq_free_queue()
  block: blk-mq: make blk_sync_queue support mq
  block: blk-mq: support draining mq queue
  dm cache: increment bi_remaining when bi_end_io is restored
  block: fixup for generic bio chaining
  block: Really silence spurious compiler warnings
  block: Silence spurious compiler warnings
  block: Kill bio_pair_split()
  ...

MPT / PCI: Use pci_stop_and_remove_bus_device_locked()

2014-01-14T19:14:25+00:00

Race conditions are theoretically possible between the MPT PCI device
removal and the generic PCI bus rescan and device removal that can be
triggered via sysfs.

To avoid those race conditions make the MPT PCI code use
pci_stop_and_remove_bus_device_locked().

Signed-off-by: Rafael J. Wysocki 
Signed-off-by: Bjorn Helgaas

block: Kill bio_segments()/bi_vcnt usage

2013-11-24T06:33:51+00:00

When we start sharing biovecs, keeping bi_vcnt accurate for splits is
going to be error prone - and unnecessary, if we refactor some code.

So bio_segments() has to go - but most of the existing users just needed
to know if the bio had multiple segments, which is easier - add a
bio_multiple_segments() for them.

(Two of the current uses of bio_segments() are going to go away in a
couple patches, but the current implementation of bio_segments() is
unsafe as soon as we start doing driver conversions for immutable
biovecs - so implement a dumb version for bisectability, it'll go away
in a couple patches)

Signed-off-by: Kent Overstreet 
Cc: Jens Axboe 
Cc: Neil Brown 
Cc: Nagalakshmi Nandigama 
Cc: Sreekanth Reddy 
Cc: "James E.J. Bottomley"