scsi: mptscsih: Fix read sense data size
The sense data buffer in sense_buf_pool is allocated with size of MPT_SENSE_BUFFER_ALLOC(64) (multiplied by req_depth) while SNS_LEN(sc)(96) is used when reading the data. That may lead to a read from unallocated area, sometimes from another (unallocated) page. To fix this, limit the read size to MPT_SENSE_BUFFER_ALLOC. Link: https://lore.kernel.org/r/20200616150446.4840-1-thenzl@redhat.com Co-developed-by: Stanislav Saner <ssaner@redhat.com> Signed-off-by: Stanislav Saner <ssaner@redhat.com> Signed-off-by: Tomas Henzl <thenzl@redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
This commit is contained in:
parent
936e6b85da
commit
afe89f115e
|
@ -118,8 +118,6 @@ int mptscsih_suspend(struct pci_dev *pdev, pm_message_t state);
|
|||
int mptscsih_resume(struct pci_dev *pdev);
|
||||
#endif
|
||||
|
||||
#define SNS_LEN(scp) SCSI_SENSE_BUFFERSIZE
|
||||
|
||||
|
||||
/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
|
||||
/*
|
||||
|
@ -2422,7 +2420,7 @@ mptscsih_copy_sense_data(struct scsi_cmnd *sc, MPT_SCSI_HOST *hd, MPT_FRAME_HDR
|
|||
/* Copy the sense received into the scsi command block. */
|
||||
req_index = le16_to_cpu(mf->u.frame.hwhdr.msgctxu.fld.req_idx);
|
||||
sense_data = ((u8 *)ioc->sense_buf_pool + (req_index * MPT_SENSE_BUFFER_ALLOC));
|
||||
memcpy(sc->sense_buffer, sense_data, SNS_LEN(sc));
|
||||
memcpy(sc->sense_buffer, sense_data, MPT_SENSE_BUFFER_ALLOC);
|
||||
|
||||
/* Log SMART data (asc = 0x5D, non-IM case only) if required.
|
||||
*/
|
||||
|
|
Loading…
Reference in New Issue