Commit 251be2f6 authored by Niklas Cassel's avatar Niklas Cassel Committed by Martin K. Petersen
Browse files

scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod 



Since commit f7b705c2 ("scsi: pm80xx: Set phy_attached to zero when
device is gone") UBSAN reports:

  UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17
  index 28 is out of range for type 'pm8001_phy [16]'

on rmmod when using an expander.

For a direct attached device, attached_phy contains the local phy id.
For a device behind an expander, attached_phy contains the remote phy
id, not the local phy id.

I.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a
device behind an expander, attached_phy can be much larger than
pm8001_ha->chip->n_phy (depending on the amount of phys of the
expander).

E.g. on my system pm8001_ha has 8 phys with phy ids 0-7.  One of the
ports has an expander connected.  The expander has 31 phys with phy ids
0-30.

The pm8001_ha->phy array only contains the phys of the HBA.  It does not
contain the phys of the expander.  Thus, it is wrong to use attached_phy
to index the pm8001_ha->phy array for a device behind an expander.

Thus, we can only clear phy_attached for devices that are directly
attached.

Fixes: f7b705c2 ("scsi: pm80xx: Set phy_attached to zero when device is gone")
Reviewed-by: default avatarIgor Pylypiv <ipylypiv@google.com>
Signed-off-by: default avatarNiklas Cassel <cassel@kernel.org>
Link: https://lore.kernel.org/r/20250814173215.1765055-14-cassel@kernel.org


Reviewed-by: default avatarDamien Le Moal <dlemoal@kernel.org>
Tested-by: default avatarDamien Le Moal <dlemoal@kernel.org>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent eeee1086

drivers/scsi/pm8001/pm8001_sas.c

+8 −1
Original line number Diff line number Diff line
@@ -749,6 +749,7 @@ static void pm8001_dev_gone_notify(struct domain_device *dev) 
	unsigned long flags = 0;

	struct pm8001_hba_info *pm8001_ha;

	struct pm8001_device *pm8001_dev = dev->lldd_dev;

	struct domain_device *parent_dev = dev->parent;



	pm8001_ha = pm8001_find_ha_by_dev(dev);

	spin_lock_irqsave(&pm8001_ha->lock, flags);
@@ -765,6 +766,12 @@ static void pm8001_dev_gone_notify(struct domain_device *dev) 
			spin_lock_irqsave(&pm8001_ha->lock, flags);

		}

		PM8001_CHIP_DISP->dereg_dev_req(pm8001_ha, device_id);



		/*

		 * The phy array only contains local phys. Thus, we cannot clear

		 * phy_attached for a device behind an expander.

		 */

		if (!(parent_dev && dev_is_expander(parent_dev->dev_type)))

			pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0;

		pm8001_free_dev(pm8001_dev);

	} else {