From: "Martin K. Petersen" <martin.petersen@oracle.com>
To: linux-scsi@vger.kernel.org
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>,
stable@vger.kernel.org,
Peter Schneider <pschneider1968@googlemail.com>
Subject: [PATCH] scsi: core: Handle devices which return an unusually large VPD page count
Date: Mon, 20 May 2024 22:30:40 -0400 [thread overview]
Message-ID: <20240521023040.2703884-1-martin.petersen@oracle.com> (raw)
In-Reply-To: <eec6ebbf-061b-4a7b-96dc-ea748aa4d035@googlemail.com>
Peter Schneider reported that a system would no longer boot after
updating to 6.8.4. Peter bisected the issue and identified commit
b5fc07a5fb56 ("scsi: core: Consult supported VPD page list prior to
fetching page") as being the culprit.
Turns out the enclosure device in Peter's system reports a byteswapped
page length for VPD page 0. It reports "02 00" as page length instead
of "00 02". This causes us to attempt to access 516 bytes (page length
+ header) of information despite only 2 pages being present.
Limit the page search scope to the size of our VPD buffer to guard
against devices returning a larger page count than requested.
Cc: stable@vger.kernel.org
Reported-by: Peter Schneider <pschneider1968@googlemail.com>
Tested-by: Peter Schneider <pschneider1968@googlemail.com>
Fixes: b5fc07a5fb56 ("scsi: core: Consult supported VPD page list prior to fetching page")
Link: https://lore.kernel.org/all/eec6ebbf-061b-4a7b-96dc-ea748aa4d035@googlemail.com/
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
---
drivers/scsi/scsi.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index 3e0c0381277a..f0464db3f9de 100644
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -350,6 +350,13 @@ static int scsi_get_vpd_size(struct scsi_device *sdev, u8 page)
if (result < SCSI_VPD_HEADER_SIZE)
return 0;
+ if (result > sizeof(vpd)) {
+ dev_warn_once(&sdev->sdev_gendev,
+ "%s: long VPD page 0 length: %d bytes\n",
+ __func__, result);
+ result = sizeof(vpd);
+ }
+
result -= SCSI_VPD_HEADER_SIZE;
if (!memchr(&vpd[SCSI_VPD_HEADER_SIZE], page, result))
return 0;
--
2.44.0
next prev parent reply other threads:[~2024-05-21 2:31 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-05-06 5:19 Kernel 6.8.4 regression: aacraid controller not initialized any more, system boot hangs Peter Schneider
2024-05-09 1:38 ` Martin K. Petersen
2024-05-09 2:12 ` Peter Schneider
2024-05-09 4:18 ` Peter Schneider
2024-05-14 7:07 ` Peter Schneider
2024-05-14 12:54 ` Martin K. Petersen
2024-05-14 13:23 ` Peter Schneider
2024-05-21 2:30 ` Martin K. Petersen [this message]
2024-05-21 13:32 ` [PATCH] scsi: core: Handle devices which return an unusually large VPD page count Peter Schneider
2024-05-23 22:57 ` Bart Van Assche
2024-05-24 8:10 ` Christoph Hellwig
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240521023040.2703884-1-martin.petersen@oracle.com \
--to=martin.petersen@oracle.com \
--cc=linux-scsi@vger.kernel.org \
--cc=pschneider1968@googlemail.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).