From 8fc01eaa8793b7c2277b4a84c218a5f8fe45ccdd Mon Sep 17 00:00:00 2001
From: Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
Date: Mon, 5 May 2014 21:41:28 -0400
Subject: [PATCH] be2iscsi: Fix memory corruption in MBX path
From: Dan Carpenter [mailto:dan.carpenter@oracle.com]
Sent: Friday, March 28, 2014 1:42 AM
Subject: re: [SCSI] be2iscsi: Fix handling timed out MBX completion from FW
Hello Jayamohan Kallickal,
The patch 1957aa7f6246: "[SCSI] be2iscsi: Fix handling timed out MBX completion from FW" from Jan 29, 2014, leads to the following static checker warning:
drivers/scsi/be2iscsi/be_main.c:5581 beiscsi_dev_probe()
error: memset() '&phba->ctrl.ptag_state[i]->tag_mem_state' too small (24 vs 32)
drivers/scsi/be2iscsi/be_main.c
5576 for (i = 0; i < MAX_MCC_CMD; i++) {
5577 init_waitqueue_head(&phba->ctrl.mcc_wait[i + 1]);
5578 phba->ctrl.mcc_tag[i] = i + 1;
5579 phba->ctrl.mcc_numtag[i + 1] = 0;
5580 phba->ctrl.mcc_tag_available++;
5581 memset(&phba->ctrl.ptag_state[i].tag_mem_state, 0,
5582 sizeof(struct beiscsi_mcc_tag_state));
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Probably this this be change to sizeof(struct be_dma_mem struct)? It looks like we are corrupting memory a bit here.
5583 }
regards,
dan carpenter
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
Signed-off-by: Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
---
drivers/scsi/be2iscsi/be_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
index e9f01a5f360b5..e202ab32d13e5 100644
--- a/drivers/scsi/be2iscsi/be_main.c
+++ b/drivers/scsi/be2iscsi/be_main.c
@@ -5625,7 +5625,7 @@ static int beiscsi_dev_probe(struct pci_dev *pcidev,
phba->ctrl.mcc_numtag[i + 1] = 0;
phba->ctrl.mcc_tag_available++;
memset(&phba->ctrl.ptag_state[i].tag_mem_state, 0,
- sizeof(struct beiscsi_mcc_tag_state));
+ sizeof(struct be_dma_mem));
}
phba->ctrl.mcc_alloc_index = phba->ctrl.mcc_free_index = 0;
--
2.30.2