• Jayamohan Kallickal's avatar
    be2iscsi: Fix memory corruption in MBX path · 8fc01eaa
    Jayamohan Kallickal authored
     From: Dan Carpenter [mailto:dan.carpenter@oracle.com]
     Sent: Friday, March 28, 2014 1:42 AM
     Subject: re: [SCSI] be2iscsi: Fix handling timed out MBX completion from FW
    
     Hello Jayamohan Kallickal,
    
     The patch 1957aa7f: "[SCSI] be2iscsi: Fix handling timed out MBX completion from FW" from Jan 29, 2014, leads to the following static checker warning:
    
     drivers/scsi/be2iscsi/be_main.c:5581 beiscsi_dev_probe()
     error: memset() '&phba->ctrl.ptag_state[i]->tag_mem_state' too small (24 vs 32)
    
     drivers/scsi/be2iscsi/be_main.c
     5576          for (i = 0; i < MAX_MCC_CMD; i++) {
     5577                  init_waitqueue_head(&phba->ctrl.mcc_wait[i + 1]);
     5578                  phba->ctrl.mcc_tag[i] = i + 1;
     5579                  phba->ctrl.mcc_numtag[i + 1] = 0;
     5580                  phba->ctrl.mcc_tag_available++;
     5581                  memset(&phba->ctrl.ptag_state[i].tag_mem_state, 0,
     5582                         sizeof(struct beiscsi_mcc_tag_state));
                                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
     Probably this this be change to sizeof(struct be_dma_mem struct)?  It looks like we are corrupting memory a bit here.
    
     5583          }
    
     regards,
     dan carpenter
    Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: default avatarJohn Soni Jose <sony.john-n@emulex.com>
    Signed-off-by: default avatarJayamohan Kallickal <jayamohan.kallickal@emulex.com>
    Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
    8fc01eaa
be_main.c 161 KB