From patchwork Sun Jan 26 15:17:47 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Colin King X-Patchwork-Id: 11351905 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id AFD9714B4 for ; Sun, 26 Jan 2020 15:17:54 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 964FA2083E for ; Sun, 26 Jan 2020 15:17:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726545AbgAZPRv (ORCPT ); Sun, 26 Jan 2020 10:17:51 -0500 Received: from youngberry.canonical.com ([91.189.89.112]:32834 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725907AbgAZPRv (ORCPT ); Sun, 26 Jan 2020 10:17:51 -0500 Received: from 1.general.cking.uk.vpn ([10.172.193.212] helo=localhost) by youngberry.canonical.com with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1ivjfX-00088L-B9; Sun, 26 Jan 2020 15:17:47 +0000 From: Colin King To: "James E . J . Bottomley" , "Martin K . Petersen" , linux-scsi@vger.kernel.org Cc: kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] scsi: mvsas: ensure loop counter phy_no does not wrap and cause an infinite loop Date: Sun, 26 Jan 2020 15:17:47 +0000 Message-Id: <20200126151747.33320-1-colin.king@canonical.com> X-Mailer: git-send-email 2.24.0 MIME-Version: 1.0 Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org From: Colin Ian King The loop counter phy_no is a u8 where as the upper limit of the loop is a u32. In the event that upper limit is greater than 255 we end up with an infinite loop since phy_no will wrap around an never reach upper loop limit. Fix this by making phy_no a u32. Addresses-Coverity: ("Infinite loop") Fixes: 20b09c2992fe ("[SCSI] mvsas: add support for 94xx; layout change; bug fixes") Signed-off-by: Colin Ian King --- drivers/scsi/mvsas/mv_sas.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c index a920eced92ec..9c03f23bde54 100644 --- a/drivers/scsi/mvsas/mv_sas.c +++ b/drivers/scsi/mvsas/mv_sas.c @@ -1940,7 +1940,7 @@ static void mvs_sig_time_out(struct timer_list *t) { struct mvs_phy *phy = from_timer(phy, t, timer); struct mvs_info *mvi = phy->mvi; - u8 phy_no; + u32 phy_no; for (phy_no = 0; phy_no < mvi->chip->n_phy; phy_no++) { if (&mvi->phy[phy_no] == phy) {