summaryrefslogtreecommitdiffstats
path: root/drivers/scsi/hpsa.c
diff options
context:
space:
mode:
authorScott Teel <scott.teel@hp.com>2011-10-26 16:21:12 -0500
committerJames Bottomley <JBottomley@Parallels.com>2011-10-30 14:34:04 +0400
commitb7ec021fe6fe979dbd4e62604a4942f964b12864 (patch)
tree1fb695d21736aa12d6144fcd373aee9fe1b6dc54 /drivers/scsi/hpsa.c
parentcfe5badcab2e993e71ebebbc07c21c270e5580c0 (diff)
downloadop-kernel-dev-b7ec021fe6fe979dbd4e62604a4942f964b12864.zip
op-kernel-dev-b7ec021fe6fe979dbd4e62604a4942f964b12864.tar.gz
[SCSI] hpsa: fix potential array overflow in hpsa_update_scsi_devices
The currentsd[] array in hpsa_update_scsi_devices had room for 256 devices. The code was iterating over however many physical and logical devices plus an additional number of possible external MSA2XXX controllers, which together could potentially exceed 256. We increased the size of the currentsd array to 1024 + 1024 + 32 + 1 elements to reflect a reasonable maximum possible number of devices which might be encountered. We also don't just walk off the end of the array if the array controller reports more devices than we are prepared to handle, we just ignore the excessive devices. Signed-off-by: Scott Teel <scott.teel@hp.com> Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Diffstat (limited to 'drivers/scsi/hpsa.c')
-rw-r--r--drivers/scsi/hpsa.c8
1 files changed, 7 insertions, 1 deletions
diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index f661ad1..f3fd9f1 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -1734,7 +1734,6 @@ static int add_msa2xxx_enclosure_device(struct ctlr_info *h,
if (is_scsi_rev_5(h))
return 0; /* p1210m doesn't need to do this. */
-#define MAX_MSA2XXX_ENCLOSURES 32
if (*nmsa2xxx_enclosures >= MAX_MSA2XXX_ENCLOSURES) {
dev_warn(&h->pdev->dev, "Maximum number of MSA2XXX "
"enclosures exceeded. Check your hardware "
@@ -1868,6 +1867,13 @@ static void hpsa_update_scsi_devices(struct ctlr_info *h, int hostno)
/* Allocate the per device structures */
for (i = 0; i < ndevs_to_allocate; i++) {
+ if (i >= HPSA_MAX_DEVICES) {
+ dev_warn(&h->pdev->dev, "maximum devices (%d) exceeded."
+ " %d devices ignored.\n", HPSA_MAX_DEVICES,
+ ndevs_to_allocate - HPSA_MAX_DEVICES);
+ break;
+ }
+
currentsd[i] = kzalloc(sizeof(*currentsd[i]), GFP_KERNEL);
if (!currentsd[i]) {
dev_warn(&h->pdev->dev, "out of memory at %s:%d\n",
OpenPOWER on IntegriCloud