scsi: message: fusion: Replace all non-returning strlcpy() with strscpy()

strlcpy() reads the entire source buffer first. This read may exceed the
destination size limit. This is both inefficient

scsi: message: fusion: Replace all non-returning strlcpy() with strscpy()

strlcpy() reads the entire source buffer first. This read may exceed the
destination size limit. This is both inefficient and can lead to linear
read overflows if a source string is not NUL-terminated [1]. In an effort
to remove strlcpy() completely [2], replace strlcpy() here with strscpy().
No return values were used, so direct replacement is safe.

[1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy
[2] https://github.com/KSPP/linux/issues/89

Signed-off-by: Azeem Shaikh <azeemshaikh38@gmail.com>
Link: https://lore.kernel.org/r/20230530160248.411637-1-azeemshaikh38@gmail.com
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

show more ...

scsi: message: fusion: Remove variable 'where'

Variable 'where' is just being incremented and it's never used
anywhere else. Remove it.

Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
Link:

scsi: message: fusion: Remove variable 'where'

Variable 'where' is just being incremented and it's never used
anywhere else. Remove it.

Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
Link: https://lore.kernel.org/r/20221031154538.870223-1-colin.i.king@gmail.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

show more ...

scsi: message: fusion: Remove redundant variable iocnum

Variable iocnum is assigned a value that is never read, the assignment and
hence the variable are redundant can be removed. Also update the co

scsi: message: fusion: Remove redundant variable iocnum

Variable iocnum is assigned a value that is never read, the assignment and
hence the variable are redundant can be removed. Also update the comment to
reflect the correct name of the variable being updated.

Cleans up clang-scan warning:

drivers/message/fusion/mptctl.c:641:8: warning: Although the value stored
to 'iocnum' is used in the enclosing expression, the value is never
actually read from 'iocnum' [deadcode.DeadStores]

Link: https://lore.kernel.org/r/20220805113214.2339022-1-colin.i.king@gmail.com
Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

show more ...

scsi: message: fusion: Remove unused variable retval

The following warning showed up when compiling with W=1.

drivers/message/fusion/mptctl.c: In function ‘mptctl_hp_hostinfo’:
drivers/message/fusi

scsi: message: fusion: Remove unused variable retval

The following warning showed up when compiling with W=1.

drivers/message/fusion/mptctl.c: In function ‘mptctl_hp_hostinfo’:
drivers/message/fusion/mptctl.c:2337:8: warning: variable ‘retval’ set but not used [-Wunused-but-set-variable]
int retval;

Fixing by removing the variable.

Link: https://lore.kernel.org/r/20220317030325.30526-1-alexander.vorwerk@stud.uni-goettingen.de
Signed-off-by: Alexander Vorwerk <alexander.vorwerk@stud.uni-goettingen.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

show more ...

scsi: message: fusion: mptctl: Use dma_alloc_coherent()

In [1], Christoph Hellwig has proposed to remove the wrappers in
include/linux/pci-dma-compat.h.

Some reasons why this API should be removed

scsi: message: fusion: mptctl: Use dma_alloc_coherent()

In [1], Christoph Hellwig has proposed to remove the wrappers in
include/linux/pci-dma-compat.h.

Some reasons why this API should be removed have been given by Julia
Lawall in [2].

When memory is allocated in kbuf_alloc_2_sgl() GFP_KERNEL can be used
because this function already uses the GFP_USER flag for some memory
allocation and not spin_lock is taken in the between.

When memory is allocated in mptctl_do_mpt_command() GFP_KERNEL can be used
because this function already uses copy_from_user() and this function can
sleep.

When memory is allocated in mptctl_hp_hostinfo() GFP_KERNEL can be used
because this function already uses mpt_config() and this function has an
explicit might_sleep().

When memory is allocated in mptctl_hp_targetinfo() GFP_KERNEL can be used
because this function already uses mpt_config() and this function has an
explicit might_sleep().

[1]: https://lore.kernel.org/kernel-janitors/20200421081257.GA131897@infradead.org/
[2]: https://lore.kernel.org/kernel-janitors/alpine.DEB.2.22.394.2007120902170.2424@hadrien/

Link: https://lore.kernel.org/r/516375d6d06114484533baf03aae351306100246.1641500561.git.christophe.jaillet@wanadoo.fr
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

show more ...

scsi: message: fusion: Remove usage of the deprecated "pci-dma-compat.h" API

In [1], Christoph Hellwig has proposed to remove the wrappers in
include/linux/pci-dma-compat.h.

Some reasons why this A

scsi: message: fusion: Remove usage of the deprecated "pci-dma-compat.h" API

In [1], Christoph Hellwig has proposed to remove the wrappers in
include/linux/pci-dma-compat.h.

Some reasons why this API should be removed have been given by Julia Lawall
in [2].

A coccinelle script has been used to perform the needed transformation. It
can be found in [3].

In this patch, all functions but pci_alloc_consistent() are handled.
pci_alloc_consistent() needs more attention and explanation.

[1]: https://lore.kernel.org/kernel-janitors/20200421081257.GA131897@infradead.org/
[2]: https://lore.kernel.org/kernel-janitors/alpine.DEB.2.22.394.2007120902170.2424@hadrien/
[3]: https://lore.kernel.org/kernel-janitors/20200716192821.321233-1-christophe.jaillet@wanadoo.fr/

Link: https://lore.kernel.org/r/e38e897fbd3314718315b0e357c824e3f01775d6.1641500561.git.christophe.jaillet@wanadoo.fr
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

show more ...

scsi: message: fusion: Remove unused mpt_pci driver .probe() 'id' parameter

The only two drivers don't make use of the id parameter, so drop it. This
is a step toward removing pci_dev->driver.

Lin

scsi: message: fusion: Remove unused mpt_pci driver .probe() 'id' parameter

The only two drivers don't make use of the id parameter, so drop it. This
is a step toward removing pci_dev->driver.

Link: https://lore.kernel.org/r/20211004125935.2300113-9-u.kleine-koenig@pengutronix.de
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Acked-by: Martin K. Petersen <martin.petersen@oracle.com>

show more ...

scsi: message: fusion: Remove unused local variable 'port'

Fixes the following W=1 kernel build warning:

drivers/message/fusion/mptctl.c: In function ‘mptctl_gettargetinfo
drivers/message/fusion/mp

scsi: message: fusion: Remove unused local variable 'port'

Fixes the following W=1 kernel build warning:

drivers/message/fusion/mptctl.c: In function ‘mptctl_gettargetinfo
drivers/message/fusion/mptctl.c:1372:7: warning: variable ‘port’ set but not used [-Wunused-but-set-variable]

Link: https://lore.kernel.org/r/20210408061851.3089-3-thunder.leizhen@huawei.com
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

show more ...

scsi: message: fusion: Remove unused local variable 'time_count'

Fixes the following W=1 kernel build warning:

drivers/message/fusion/mptctl.c: In function ‘mptctl_do_taskmgmt:
drivers/message/fusi

scsi: message: fusion: Remove unused local variable 'time_count'

Fixes the following W=1 kernel build warning:

drivers/message/fusion/mptctl.c: In function ‘mptctl_do_taskmgmt:
drivers/message/fusion/mptctl.c:324:17: warning: variable ‘time_count’ set but not used [-Wunused-but-set-variable]

Link: https://lore.kernel.org/r/20210408061851.3089-2-thunder.leizhen@huawei.com
Fixes: 7d757f185540 ("[SCSI] mptfusion: Updated SCSI IO IOCTL error handling.")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

show more ...

scsi: mptctl: Remove unneeded cast from memory allocation

Remove casting the values returned by memory allocation function.

Coccinelle emits WARNING:

./drivers/message/fusion/mptctl.c:2596:14-31:

scsi: mptctl: Remove unneeded cast from memory allocation

Remove casting the values returned by memory allocation function.

Coccinelle emits WARNING:

./drivers/message/fusion/mptctl.c:2596:14-31: WARNING: casting value returned by memory allocation function to (SCSIDevicePage0_t *) is useless.
./drivers/message/fusion/mptctl.c:2660:15-32: WARNING: casting value returned by memory allocation function to (SCSIDevicePage3_t *) is useless.

Link: https://lore.kernel.org/r/1596014390-18605-1-git-send-email-liheng40@huawei.com
Signed-off-by: Li Heng <liheng40@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

show more ...

scsi: mptfusion: Fix double fetch bug in ioctl

Tom Hatskevich reported that we look up "iocp" then, in the called
functions we do a second copy_from_user() and look it up again.
The problem that cou

scsi: mptfusion: Fix double fetch bug in ioctl

Tom Hatskevich reported that we look up "iocp" then, in the called
functions we do a second copy_from_user() and look it up again.
The problem that could cause is:

drivers/message/fusion/mptctl.c
674 /* All of these commands require an interrupt or
675 * are unknown/illegal.
676 */
677 if ((ret = mptctl_syscall_down(iocp, nonblock)) != 0)
^^^^
We take this lock.

678 return ret;
679
680 if (cmd == MPTFWDOWNLOAD)
681 ret = mptctl_fw_download(arg);
^^^
Then the user memory changes and we look up "iocp" again but a different
one so now we are holding the incorrect lock and have a race condition.

682 else if (cmd == MPTCOMMAND)
683 ret = mptctl_mpt_command(arg);

The security impact of this bug is not as bad as it could have been
because these operations are all privileged and root already has
enormous destructive power. But it's still worth fixing.

This patch passes the "iocp" pointer to the functions to avoid the
second lookup. That deletes 100 lines of code from the driver so
it's a nice clean up as well.

Link: https://lore.kernel.org/r/20200114123414.GA7957@kadam
Reported-by: Tom Hatskevich <tom2001tom.23@gmail.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

show more ...

scsi: mptfusion: fix indentation issues

There are several statements and code blocks there are incorrectly
indented. Fix these.

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-b

scsi: mptfusion: fix indentation issues

There are several statements and code blocks there are incorrectly
indented. Fix these.

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

show more ...

scsi: mptctl: change strncpy+truncation to strlcpy

Generated by scripts/coccinelle/misc/strncpy_truncation.cocci

Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Signed-off-by: Martin K.

scsi: mptctl: change strncpy+truncation to strlcpy

Generated by scripts/coccinelle/misc/strncpy_truncation.cocci

Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

show more ...

scsi: mptfusion: Add bounds check in mptctl_hp_targetinfo()

My static checker complains about an out of bounds read:

drivers/message/fusion/mptctl.c:2786 mptctl_hp_targetinfo()
error: buffe

scsi: mptfusion: Add bounds check in mptctl_hp_targetinfo()

My static checker complains about an out of bounds read:

drivers/message/fusion/mptctl.c:2786 mptctl_hp_targetinfo()
error: buffer overflow 'hd->sel_timeout' 255 <= u32max.

It's true that we probably should have a bounds check here.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

show more ...

scsi: mptfusion: Use snprintf() instead of open coded divisions

Numbers up to 100 snprintf() prints without using a division. Besides
that the code looks more readable.

Signed-off-by: Andy Shevche

scsi: mptfusion: Use snprintf() instead of open coded divisions

Numbers up to 100 snprintf() prints without using a division. Besides
that the code looks more readable.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

show more ...

Replace <asm/uaccess.h> with <linux/uaccess.h> globally

This was entirely automated, using the script by Al:

PATT='^[[:blank:]]*#[[:blank:]]*include[[:blank:]]*<asm/uaccess.h>'
sed -i -e "s!$PA

Replace <asm/uaccess.h> with <linux/uaccess.h> globally

This was entirely automated, using the script by Al:

PATT='^[[:blank:]]*#[[:blank:]]*include[[:blank:]]*<asm/uaccess.h>'
sed -i -e "s!$PATT!#include <linux/uaccess.h>!" \
$(git grep -l "$PATT"|grep -v ^include/linux/uaccess.h)

to do the replacement at the end of the merge window.

Requested-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

show more ...

mptfusion: don't allow negative bytes in kbuf_alloc_2_sgl()

There is a static checker warning here because "bytes" is controlled by
the user and we cap the upper bound with min() but allow negatives

mptfusion: don't allow negative bytes in kbuf_alloc_2_sgl()

There is a static checker warning here because "bytes" is controlled by
the user and we cap the upper bound with min() but allow negatives.
Negative bytes will result in some nasty warning messages but are not
super harmful. Anyway, no one needs negative bytes so let's just check
for it and return NULL.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

show more ...

mptfusion: prevent some memory corruption

These are signed values the come from the user, we put a cap on the
upper bounds but not on the lower bounds.

We use "karg.dataSgeOffset" to calculate "sz"

mptfusion: prevent some memory corruption

These are signed values the come from the user, we put a cap on the
upper bounds but not on the lower bounds.

We use "karg.dataSgeOffset" to calculate "sz". We verify "sz" and
proceed as if that means that "karg.dataSgeOffset" is correct but this
fails to consider that the "sz" calculations can have integer overflows.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: James Bottomley <JBottomley@Odin.com>

show more ...

mptfusion: simplify rounding

Rounding up to a multiple of 4 should be done using the ALIGN
macro. As a bonus, this also makes the generated code smaller.

In GetIocFacts(), sz is assigned to a few l

mptfusion: simplify rounding

Rounding up to a multiple of 4 should be done using the ALIGN
macro. As a bonus, this also makes the generated code smaller.

In GetIocFacts(), sz is assigned to a few lines below without being
read in the meantime, so it is ok that it doesn't end up with the same
value as facts->FWImageSize.

Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Reviewed-by: Joe Lawrence <joe.lawrence@stratus.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>

show more ...

mptfusion: use memdup_user

Let memdup_user handle the kmalloc, copy_from_user and error checking
kfree code.

Spotted by the following smatch (false positive) warning:

drivers/message/fusion/mptc

mptfusion: use memdup_user

Let memdup_user handle the kmalloc, copy_from_user and error checking
kfree code.

Spotted by the following smatch (false positive) warning:

drivers/message/fusion/mptctl.c:1369 mptctl_getiocinfo() warn:
possible info leak 'karg'

Signed-off-by: Joe Lawrence <joe.lawrence@stratus.com>
Acked-by: Sreekanth Reddy <Sreekanth.Reddy@avagotech.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>

show more ...

mptfusion: fix msgContext in mptctl_hp_hostinfo

Hi,

without this patch the istwiRWRequest->MsgContext is always set to zero,
this patch saves the MsgContext in a msgcontext variable and then restor

mptfusion: fix msgContext in mptctl_hp_hostinfo

Hi,

without this patch the istwiRWRequest->MsgContext is always set to zero,
this patch saves the MsgContext in a msgcontext variable and then restores
the value.
Thanks to David Jeffery who found the issue and did the analysis.

Signed-off-by: Tomas Henzl <thenzl@redhat.com>
Acked-by: Desai, Kashyap <Kashyap.Desai@lsi.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>

show more ...

mptctl: don't wank with fasync in ->release()

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

drivers/message/fusion: use pci_dev->revision

This driver uses PCI_CLASS_REVISION instead of PCI_REVISION_ID, so it
wasn't converted by 44c10138fd4bbc ("PCI: Change all drivers to use
pci_device->re

drivers/message/fusion: use pci_dev->revision

This driver uses PCI_CLASS_REVISION instead of PCI_REVISION_ID, so it
wasn't converted by 44c10138fd4bbc ("PCI: Change all drivers to use
pci_device->revision").

In one case, it even reads PCI revision ID without using it -- that code
is now removed...

Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Acked-by: "Nandigama, Nagalakshmi" <Nagalakshmi.Nandigama@lsi.com>
Cc: Eric Moore <eric.moore@lsi.com>
Acked-by: Auke Kok <auke-jan.h.kok@intel.com>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

show more ...

Fix common misspellings

Fixes generated by 'codespell' and manually reviewed.

Signed-off-by: Lucas De Marchi <lucas.demarchi@profusion.mobi>

[SCSI] mptfusion: mptctl_release is required in mptctl.c

Added missing release callback for file_operations mptctl_fops.
Without release callback there will be never freed. It remains on
mptctl's ee

[SCSI] mptfusion: mptctl_release is required in mptctl.c

Added missing release callback for file_operations mptctl_fops.
Without release callback there will be never freed. It remains on
mptctl's eent list even after the file is closed and released.

Relavent RHEL bugzilla is 660871

Cc: stable@kernel.org
Signed-off-by: Kashyap Desai <kashyap.desai@lsi.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>

show more ...