kernel/drivers/scsi/aacraid/aachba.c, branch linux-6.9.y

scsi: aacraid: aachba: Replace snprintf() with the safer scnprintf() variant

2024-01-30T01:34:52Z

There is a general misunderstanding amongst engineers that {v}snprintf() returns the length of the data *actually* encoded into the destination array. However, as per the C99 standard {v}snprintf() really returns the length of the data that *would have been* written if there were enough space for it. This misunderstanding has led to buffer-overruns in the past. It's generally considered safer to use the {v}scnprintf() variants in their place (or even sprintf() in simple cases). So let's do that. Link: https://lwn.net/Articles/69419/ Link: https://github.com/KSPP/linux/issues/105 Cc: Adaptec OEM Raid Solutions Cc: PMC-Sierra, Inc Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20240111131732.1815560-6-lee@kernel.org Signed-off-by: Martin K. Petersen

scsi: aacraid: Replace all non-returning strlcpy with strscpy

2023-05-26T20:52:19Z

strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated [1]. In an effort to remove strlcpy() completely [2], replace strlcpy() here with strscpy(). No return values were used, so direct replacement is safe. [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy [2] https://github.com/KSPP/linux/issues/89 Signed-off-by: Azeem Shaikh Reviewed-by: Kees Cook Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20230517143049.1519806-1-azeemshaikh38@gmail.com

scsi: aacraid: Allocate cmd_priv with scsicmd

2023-02-08T23:49:48Z

The aac_priv() helper assumes that the private cmd area immediately follows struct scsi_cmnd. Allocate this space as part of scsicmd, else there is a risk of heap overflow. Seen with GCC 13: ../drivers/scsi/aacraid/aachba.c: In function 'aac_probe_container': ../drivers/scsi/aacraid/aachba.c:841:26: warning: array subscript 16 is outside array bounds of 'void[392]' [-Warray-bounds=] 841 | status = cmd_priv->status; | ^~ In file included from ../include/linux/resource_ext.h:11, from ../include/linux/pci.h:40, from ../drivers/scsi/aacraid/aachba.c:22: In function 'kmalloc', inlined from 'kzalloc' at ../include/linux/slab.h:720:9, inlined from 'aac_probe_container' at ../drivers/scsi/aacraid/aachba.c:821:30: ../include/linux/slab.h:580:24: note: at offset 392 into object of size 392 allocated by 'kmalloc_trace' 580 | return kmalloc_trace( | ^~~~~~~~~~~~~~ 581 | kmalloc_caches[kmalloc_type(flags)][index], | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 582 | flags, size); | ~~~~~~~~~~~~ Fixes: 76a3451b64c6 ("scsi: aacraid: Move the SCSI pointer to private command data") Link: https://lore.kernel.org/r/20230128000409.never.976-kees@kernel.org Cc: Bart Van Assche Cc: Hannes Reinecke Cc: Himanshu Madhani Cc: Adaptec OEM Raid Solutions Cc: "James E.J. Bottomley" Cc: "Martin K. Petersen" Cc: linux-scsi@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Kees Cook Reviewed-by: Vegard Nossum Reviewed-by: Hannes Reinecke Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen

scsi: aacraid: Remove redundant "the"

2022-06-22T01:39:55Z

Remove redundant "the" in comment. Link: https://lore.kernel.org/r/20220621142346.6429-1-jiangjian@cdjrlc.com Signed-off-by: Jiang Jian Signed-off-by: Martin K. Petersen

scsi: aacraid: Move the SCSI pointer to private command data

2022-02-23T02:11:03Z

Set .cmd_size in the SCSI host template instead of using the SCSI pointer from struct scsi_cmnd. This patch prepares for removal of the SCSI pointer from struct scsi_cmnd. Link: https://lore.kernel.org/r/20220218195117.25689-13-bvanassche@acm.org Reviewed-by: Hannes Reinecke Reviewed-by: Himanshu Madhani Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen

scsi: aacraid: Fix spelling of "its"

2022-01-05T05:23:47Z

Use the possessive "its" instead of the contraction "it's" in user messages. Link: https://lore.kernel.org/r/20211223061119.18304-1-rdunlap@infradead.org Cc: Adaptec OEM Raid Solutions Cc: "James E.J. Bottomley" Cc: "Martin K. Petersen" Signed-off-by: Randy Dunlap Signed-off-by: Martin K. Petersen

scsi: aacraid: Call scsi_done() directly

2021-10-17T01:28:45Z

The aacraid driver invokes scmd->scsi_done(scmd) for two types of SCSI commands: - SCSI commands initialized by the SCSI mid-layer. - SCSI commands initialized by aac_probe_container(). The processing sequence for SCSI commands allocated by aac_probe_container() is as follows: aac_probe_container() -> _aac_probe_container(scmd, aac_probe_container_callback1) -> scmd->SCp.ptr = aac_probe_container_callback1 -> aac_fib_send(..., _aac_probe_container1, scmd) -> fibptr->callback = _aac_probe_container1 -> fibptr->callback_data = scmd fibptr->callback(scmd) -> _aac_probe_container1(scmd, fibptr) [ ... ] -> _aac_probe_container2(scmd, fibptr) -> Call scmd->SCp.ptr == aac_probe_container_callback1 -> scmd->device = NULL; The processing sequence for SCSI commands allocated by the SCSI mid-layer if _aac_probe_container() is called is as follows: aac_queuecommand() -> aac_scsi_cmd() -> _aac_probe_container(scmd, aac_probe_container_callback2) -> scmd->SCp.ptr = aac_probe_container_callback2 -> aac_fib_send(..., _aac_probe_container1, scmd) fibptr->callback(scmd) -> _aac_probe_container1(scmd, fibptr) [ ... ] -> _aac_probe_container2(scmd, fibptr) -> Call scmd->SCp.ptr == aac_probe_container_callback2 Preserve the existing call sequences by calling scsi_done() for commands submitted by the mid-layer or aac_probe_container_scsi_done() for commands submitted by aac_probe_container(). Link: https://lore.kernel.org/r/20211007202923.2174984-17-bvanassche@acm.org Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen

scsi: aacraid: Introduce aac_scsi_done()

2021-10-17T01:28:44Z

This patch does not change any functionality but makes the next patch in this series easier to read. Link: https://lore.kernel.org/r/20211007202923.2174984-16-bvanassche@acm.org Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen

scsi: aacraid: Use scsi_cmd_to_rq() instead of scsi_cmnd.request

2021-08-12T02:25:38Z

Prepare for removal of the request pointer by using scsi_cmd_to_rq() instead. This patch does not change any functionality. Link: https://lore.kernel.org/r/20210809230355.8186-14-bvanassche@acm.org Reviewed-by: Hannes Reinecke Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen

scsi: aacraid: Remove an unused include

2021-07-19T01:46:53Z

flush_kernel_dcache_page() is not used by aacraid, and this header already comes in through the scatterlist/block headers anyway. Link: https://lore.kernel.org/r/20210712060928.4161649-6-hch@lst.de Signed-off-by: Christoph Hellwig Signed-off-by: Martin K. Petersen