[mpt2sas] fix NULL pointer at ioc->pfacts

Orabug: 14040678
The ioc->pfacts member in the IOC structure is getting set to zero
following a call to _base_get_ioc_facts due to the memset in that routine.
So if the ioc->pfacts was read after a host reset, there would be a NULL
pointer dereference. The routine _base_get_ioc_facts is called from context
of host reset.  The problem in _base_get_ioc_facts  is the size of
Mpi2IOCFactsReply is 64, whereas the sizeof "struct mpt2sas_facts" is 60,
so there is a four byte overflow resulting from the memset.

Also, there is memset in _base_get_port_facts using the incorrect structure,
it should be "struct mpt2sas_port_facts" instead of Mpi2PortFactsReply.

Signed-off-by: Nagalakshmi Nandigama <nagalakshmi.nandigama@lsi.com>
Signed-off-by: Maxim Uvarov <maxim.uvarov@oracle.com>

diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.c b/drivers/scsi/mpt2sas/mpt2sas_base.c
index c48ca9d6bac0cfbb51e58fbda14974cc8af5c3bf..cb20c13f7b102dedd02e30107570573bb4690f6c 100644 (file)
--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
@@ -3362,7 +3362,7 @@ _base_get_port_facts(struct MPT2SAS_ADAPTER *ioc, int port, int sleep_flag)
        }
 
        pfacts = &ioc->pfacts[port];
-       memset(pfacts, 0, sizeof(Mpi2PortFactsReply_t));
+       memset(pfacts, 0, sizeof(struct mpt2sas_port_facts));
        pfacts->PortNumber = mpi_reply.PortNumber;
        pfacts->VP_ID = mpi_reply.VP_ID;
        pfacts->VF_ID = mpi_reply.VF_ID;
@@ -3404,7 +3404,7 @@ _base_get_ioc_facts(struct MPT2SAS_ADAPTER *ioc, int sleep_flag)
        }
 
        facts = &ioc->facts;
-       memset(facts, 0, sizeof(Mpi2IOCFactsReply_t));
+       memset(facts, 0, sizeof(struct mpt2sas_facts));
        facts->MsgVersion = le16_to_cpu(mpi_reply.MsgVersion);
        facts->HeaderVersion = le16_to_cpu(mpi_reply.HeaderVersion);
        facts->VP_ID = mpi_reply.VP_ID;
@@ -4282,7 +4282,7 @@ mpt2sas_base_attach(struct MPT2SAS_ADAPTER *ioc)
                goto out_free_resources;
 
        ioc->pfacts = kcalloc(ioc->facts.NumberOfPorts,
-           sizeof(Mpi2PortFactsReply_t), GFP_KERNEL);
+           sizeof(struct mpt2sas_port_facts), GFP_KERNEL);
        if (!ioc->pfacts) {
                r = -ENOMEM;
                goto out_free_resources;