[Devel] [PATCH RHEL7 COMMIT] ms/ses: fix additional element traversal bug

[Konstantin Khorenko]

The commit is pushed to "branch-rh7-3.10.0-229.7.2.vz7.9.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-229.7.2.vz7.9.18
------>
commit 517d6f84f178029d2373bae81d72982ebbb319f9
Author: James Bottomley <James.Bottomley at HansenPartnership.com>
Date:   Mon Dec 28 17:06:50 2015 +0400

    ms/ses: fix additional element traversal bug
    
    KASAN found that our additional element processing scripts drop off
    the end of the VPD page into unallocated space.  The reason is that
    not every element has additional information but our traversal
    routines think they do, leading to them expecting far more additional
    information than is present.  Fix this by adding a gate to the
    traversal routine so that it only processes elements that are expected
    to have additional information (list is in SES-2 section 6.1.13.1:
    Additional Element Status diagnostic page overview)
    
    Reported-by: Pavel Tikhomirov <ptikhomirov at virtuozzo.com>
    Tested-by: Pavel Tikhomirov <ptikhomirov at virtuozzo.com>
    Cc: stable at vger.kernel.org
    Signed-off-by: James Bottomley <James.Bottomley at HansenPartnership.com>
    Signed-off-by: Pavel Tikhomirov <ptikhomirov at virtuozzo.com>
    
    Reviewed-by: Hannes Reinecke <hare at suse.com>
    
    https://jira.sw.ru/browse/PSBM-40330
    Signed-off-by: Pavel Tikhomirov <ptikhomirov at virtuozzo.com>
---
 drivers/scsi/ses.c        | 10 +++++++++-
 include/linux/enclosure.h |  4 ++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
index 80bfece..dab7f6b 100644
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -437,7 +437,15 @@ static void ses_enclosure_data_process(struct enclosure_device *edev,
 			if (desc_ptr)
 				desc_ptr += len;
 
-			if (addl_desc_ptr)
+			if (addl_desc_ptr &&
+			    /* only find additional descriptions for specific devices */
+			    (type_ptr[0] == ENCLOSURE_COMPONENT_DEVICE ||
+			     type_ptr[0] == ENCLOSURE_COMPONENT_ARRAY_DEVICE ||
+			     type_ptr[0] == ENCLOSURE_COMPONENT_SAS_EXPANDER ||
+			     /* these elements are optional */
+			     type_ptr[0] == ENCLOSURE_COMPONENT_SCSI_TARGET_PORT ||
+			     type_ptr[0] == ENCLOSURE_COMPONENT_SCSI_INITIATOR_PORT ||
+			     type_ptr[0] == ENCLOSURE_COMPONENT_CONTROLLER_ELECTRONICS))
 				addl_desc_ptr += addl_desc_ptr[1] + 2;
 
 		}
diff --git a/include/linux/enclosure.h b/include/linux/enclosure.h
index 9a33c5f..f6c229e 100644
--- a/include/linux/enclosure.h
+++ b/include/linux/enclosure.h
@@ -29,7 +29,11 @@
 /* A few generic types ... taken from ses-2 */
 enum enclosure_component_type {
 	ENCLOSURE_COMPONENT_DEVICE = 0x01,
+	ENCLOSURE_COMPONENT_CONTROLLER_ELECTRONICS = 0x07,
+	ENCLOSURE_COMPONENT_SCSI_TARGET_PORT = 0x14,
+	ENCLOSURE_COMPONENT_SCSI_INITIATOR_PORT = 0x15,
 	ENCLOSURE_COMPONENT_ARRAY_DEVICE = 0x17,
+	ENCLOSURE_COMPONENT_SAS_EXPANDER = 0x18,
 };
 
 /* ses-2 common element status */