diff options
| author | Chandrakanth Patil <chandrakanth.patil@broadcom.com> | 2026-08-26 02:34:07 +0530 |
|---|---|---|
| committer | Martin K. Petersen (Oracle) <mkp@kernel.org> | 2026-09-09 22:08:16 -0400 |
| commit | 203b3072e7aa10d98b3f2b766693ea925cfc571d (patch) | |
| tree | d7ad38de6772a705d5fbbe696f7ebf49402ba204 | |
| parent | f67caaa2521a3c8f931d1e679d831ba5ca654794 (diff) | |
| download | linux-next-203b3072e7aa10d98b3f2b766693ea925cfc571d.tar.gz linux-next-203b3072e7aa10d98b3f2b766693ea925cfc571d.zip | |
scsi: mpi3mr: Fix buffer overflow in the BSG target device map
The size of the target device map buffer is held in a u16 while the number
of devices it is derived from is not bounded to fit. With enough devices
the size wraps, a short buffer is allocated, and the loop that fills it
writes past the end.
Do the calculation in size_t.
Fixes: fb428a2005fc ("scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info()")
Signed-off-by: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
Link: https://patch.msgid.link/20260825210411.301535-14-chandrakanth.patil@broadcom.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
| -rw-r--r-- | drivers/scsi/mpi3mr/mpi3mr_app.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/scsi/mpi3mr/mpi3mr_app.c b/drivers/scsi/mpi3mr/mpi3mr_app.c index cd772b2cb98a..f5b48c95cf05 100644 --- a/drivers/scsi/mpi3mr/mpi3mr_app.c +++ b/drivers/scsi/mpi3mr/mpi3mr_app.c @@ -1466,7 +1466,8 @@ out: static long mpi3mr_get_all_tgt_info(struct mpi3mr_ioc *mrioc, struct bsg_job *job) { - u16 num_devices = 0, i = 0, size; + u16 num_devices = 0, i = 0; + size_t size; unsigned long flags; struct mpi3mr_tgt_dev *tgtdev; struct mpi3mr_device_map_info *devmap_info = NULL; @@ -1492,8 +1493,8 @@ static long mpi3mr_get_all_tgt_info(struct mpi3mr_ioc *mrioc, return 0; } - kern_entrylen = num_devices * sizeof(*devmap_info); - size = sizeof(u64) + kern_entrylen; + kern_entrylen = (uint32_t)num_devices * sizeof(*devmap_info); + size = sizeof(u64) + (size_t)kern_entrylen; alltgt_info = kzalloc(size, GFP_KERNEL); if (!alltgt_info) return -ENOMEM; |