Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
IronPort-SDR: MyzODQS7EGMXiAssSo64dyNo4MKf4vSfRPQXqW0Nu3WPI454JSmusQM/YgB3sErHyaC0rk0qY1
 I/qtWAGEzuufvl9tFjkrbB33nojmvBQZ7o/92smJOEOPRkIJbpmos1P0e9g3oNuHxVF3Fdk0W+
 GcsPUSCytbhcBH/LkBF37JutKdv2863v3VoruK/yyWHAFZ5Lk5R0b+1lldR7Duooyv5TjMjgvh
 aH010PmMpzE0aU4H5i7hITGBSStbe7RQvniigZzGPJOvZMHZ39JhaaiKFp0/e6rtWN1AcG6B+A
 +jw=
From:   <Don.Brace@microchip.com>
To:     <cai@lca.pw>, <don.brace@microsemi.com>
CC:     <martin.petersen@oracle.com>, <scott.teel@microsemi.com>,
        <kevin.barnett@microsemi.com>, <esc.storagedev@microsemi.com>,
        <linux-scsi@vger.kernel.org>, <linux-kernel@vger.kernel.org>
Subject: RE: UBSAN: array-index-out-of-bounds in drivers/scsi/hpsa.c:4421:7
Thread-Topic: UBSAN: array-index-out-of-bounds in drivers/scsi/hpsa.c:4421:7
Thread-Index: AQHWM3BY96yTrwyUV0WbU/zWsYVO+Ki6ezQAgAHs8AA=
Date:   Thu, 28 May 2020 13:46:02 +0000
Message-ID: <SN6PR11MB2848B54B5E6152AA4A7BC261E18E0@SN6PR11MB2848.namprd11.prod.outlook.com>
References: <20200526151416.GB991@lca.pw> <20200526151926.GC991@lca.pw>
In-Reply-To: <20200526151926.GC991@lca.pw>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 2151be55-1d39-4ba5-f18a-08d8030d7615
X-MS-Exchange-CrossTenant-originalarrivaltime: 28 May 2020 13:46:02.1933
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 3f4057f3-b418-4d4e-ba84-d55b4e897d88
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: gUctHKi+sP+FU/EIOVrhpKIW+POypdaqMaAa/tBt5BprvBa3KrJhFUzuhnq9Dyo3J/EqeBH9U9We1oq6LXBJgg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR11MB3246
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Working on this.
Can you send your configuration?
ssacli controller all show config detail

-----Original Message-----
From: linux-scsi-owner@vger.kernel.org [mailto:linux-scsi-owner@vger.kernel=
.org] On Behalf Of Qian Cai
Sent: Tuesday, May 26, 2020 10:19 AM
To: Don Brace <don.brace@microsemi.com>
Cc: Martin K. Petersen <martin.petersen@oracle.com>; Scott Teel <scott.teel=
@microsemi.com>; Kevin Barnett <kevin.barnett@microsemi.com>; esc.storagede=
v@microsemi.com; linux-scsi@vger.kernel.org; linux-kernel@vger.kernel.org
Subject: UBSAN: array-index-out-of-bounds in drivers/scsi/hpsa.c:4421:7

EXTERNAL EMAIL: Do not click links or open attachments unless you know the =
content is safe

Sorry, adding a missing subject line.

On Tue, May 26, 2020 at 11:14:16AM -0400, Qian Cai wrote:
> The commit 64ce60cab246 ("hpsa: correct skipping masked peripherals")=20
> trigger an UBSAN warning below.
>
> When i =3D=3D 0 in hpsa_update_scsi_devices(),
>
> for (i =3D 0; i < nphysicals + nlogicals + 1; i++) { ...
>         int phys_dev_index =3D i - (raid_ctlr_position =3D=3D 0);
>
> It ends up calling LUN[-1].
>
> &physdev_list->LUN[phys_dev_index]
>
> Should there by a test of underflow to set phys_dev_index =3D=3D 0 in thi=
s case?
>
> [  118.395557][   T13] hpsa can't handle SMP requests
> [  118.444870][   T13] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
> [  118.486725][   T13] UBSAN: array-index-out-of-bounds in drivers/scsi/h=
psa.c:4421:7
> [  118.521606][   T13] index -1 is out of range for type 'struct ext_repo=
rt_lun_entry [1024]'
> [  118.559481][   T13] CPU: 0 PID: 13 Comm: kworker/0:1 Not tainted 5.7.0=
-rc6-next-20200522+ #3
> [  118.598179][   T13] Hardware name: HP ProLiant BL660c Gen9, BIOS I38 1=
0/17/2018
> [  118.632882][   T13] Workqueue: events work_for_cpu_fn
> [  118.656492][   T13] Call Trace:
> [  118.670899][   T13]  dump_stack+0x10b/0x17f
> [  118.690216][   T13]  __ubsan_handle_out_of_bounds+0xd2/0x110
> [  118.712593][  T378] bnx2x 0000:41:00.1: 63.008 Gb/s available PCIe ban=
dwidth (8.0 GT/s PCIe x8 link)
> [  118.716249][   T13]  hpsa_update_scsi_devices+0x28e3/0x2cc0 [hpsa]
> [  118.786774][   T13]  hpsa_scan_start+0x228/0x260 [hpsa]
> [  118.810663][   T13]  ? _raw_spin_unlock_irqrestore+0x6a/0x80
> [  118.836529][   T13]  do_scsi_scan_host+0x8a/0x110
> [  118.858104][   T13]  scsi_scan_host+0x222/0x280
> [  118.879287][   T13]  ? hpsa_scsi_do_inquiry+0xcd/0xe0 [hpsa]
> [  118.907707][   T13]  hpsa_init_one+0x1b79/0x27c0 [hpsa]
> [  118.934818][   T13]  ? hpsa_find_device_by_sas_rphy+0xd0/0xd0 [hpsa]
> [  118.964279][   T13]  local_pci_probe+0x82/0xe0
> [  118.985405][   T13]  ? pci_name+0x70/0x70
> [  119.004244][   T13]  work_for_cpu_fn+0x3a/0x60
> [  119.024672][   T13]  process_one_work+0x49f/0x8f0
> [  119.046431][   T13]  process_scheduled_works+0x72/0xa0
> [  119.069906][   T13]  worker_thread+0x463/0x5b0
> [  119.090347][   T13]  kthread+0x21d/0x240
> [  119.108531][   T13]  ? pr_cont_work+0xa0/0xa0
> [  119.128450][   T13]  ? __write_once_size+0x30/0x30
> [  119.150405][   T13]  ret_from_fork+0x27/0x40