Unverified Commit cb520788 authored Apr 29, 2024 by openeuler-ci-bot Committed by Gitee Apr 29, 2024

!6739 v2 Apply patches of ses from stable

Merge Pull Request from: @ci-robot 
 
PR sync from: Li Lingfeng <lilingfeng3@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/LSGIEKGSILJA2H2FLJYWNRBQ5F2VTIUN/ 
v1->v2:
  Add fixes tag.

Jiri Kosina (1):
  scsi: ses: Handle enclosure with just a primary component gracefully

Li Lingfeng (3):
  Revert "scsi: ses: fix slab-out-of-bounds in
    ses_enclosure_data_process"
  Revert "scsi: ses: Fix crash caused by kfree an invalid pointer"
  Revert "scsi: ses: Handle enclosure with just a primary component
    gracefully"

Tomas Henzl (1):
  scsi: ses: Fix possible desc_ptr out-of-bounds accesses


-- 
2.31.1
 
https://gitee.com/openeuler/kernel/issues/I9K8D1 
 
Link:https://gitee.com/openeuler/kernel/pulls/6739

 

Reviewed-by: Yu Kuai <yukuai3@huawei.com>
Reviewed-by: Jialin Zhang <zhangjialin11@huawei.com>
Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com>

parents 3a521e13 0dc7c462

drivers/scsi/ses.c

+12 −9

Original line number	Diff line number	Diff line
		@@ -569,17 +569,21 @@ static void ses_enclosure_data_process(struct enclosure_device *edev,
		int max_desc_len;

		if (desc_ptr) {
		if (desc_ptr + 3 >= buf + page7_len) {
		desc_ptr = NULL;
		} else {
		len = (desc_ptr[2] << 8) + desc_ptr[3];
		desc_ptr += 4;
		if (desc_ptr + len > buf + page7_len) {
		if (desc_ptr + len > buf + page7_len)
		desc_ptr = NULL;
		} else {
		else {
		/* Add trailing zero - pushes into
		* reserved space */
		desc_ptr[len] = '\0';
		name = desc_ptr;
		}
		}
		}
		if (type_ptr[0] == ENCLOSURE_COMPONENT_DEVICE \|\|
		type_ptr[0] == ENCLOSURE_COMPONENT_ARRAY_DEVICE) {

		@@ -848,7 +852,6 @@ static void ses_intf_remove_enclosure(struct scsi_device *sdev)
		kfree(ses_dev->page2);
		kfree(ses_dev);

		if (edev->components > 0)
		kfree(edev->component[0].scratch);

		put_device(&edev->edev);