diff options
| author | Chris Leech <cleech@redhat.com> | 2016-06-30 08:32:36 -0700 |
|---|---|---|
| committer | Martin K. Petersen <martin.petersen@oracle.com> | 2016-07-13 21:49:57 -0400 |
| commit | fa06883281afaa158b2b350f16c377c448df6b61 (patch) | |
| tree | 6f41d942268a64f6c64a6a25eb8eb17f4e6f2ec6 | |
| parent | 4b9bc86d5a999e344098303882d6395d39e36c13 (diff) | |
libfc: sanity check cpu number extracted from xid
In the receive path libfc extracts a cpu number from the ox_id in the
fiber channel header and uses that to do a per_cpu_ptr conversion. If,
for some reason, a frame is received with an invalid ox_id, per_cpu_ptr
will return an invalid pointer and the libfc receive path will panic the
system trying to use it.
I'm currently looking at such a case, and I don't yet know why a cpu
number > nr_cpu_ids is appearing in an exchange id. But adding a sanity
check in libfc prevents a system panic, and seems like good idea when
dealing with frames coming in from the network.
Signed-off-by: Chris Leech <cleech@redhat.com>
Acked-by: Johannes Thumshirn <jth@kernel.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
| -rw-r--r-- | drivers/scsi/libfc/fc_exch.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c index 30f9ef0c0d4f..e72673b0a8fb 100644 --- a/drivers/scsi/libfc/fc_exch.c +++ b/drivers/scsi/libfc/fc_exch.c @@ -908,9 +908,17 @@ static struct fc_exch *fc_exch_find(struct fc_exch_mgr *mp, u16 xid) { struct fc_exch_pool *pool; struct fc_exch *ep = NULL; + u16 cpu = xid & fc_cpu_mask; + + if (cpu >= nr_cpu_ids || !cpu_possible(cpu)) { + printk_ratelimited(KERN_ERR + "libfc: lookup request for XID = %d, " + "indicates invalid CPU %d\n", xid, cpu); + return NULL; + } if ((xid >= mp->min_xid) && (xid <= mp->max_xid)) { - pool = per_cpu_ptr(mp->pool, xid & fc_cpu_mask); + pool = per_cpu_ptr(mp->pool, cpu); spin_lock_bh(&pool->lock); ep = fc_exch_ptr_get(pool, (xid - mp->min_xid) >> fc_cpu_order); if (ep) { |