diff options
| author | Chandrakanth Patil <chandrakanth.patil@broadcom.com> | 2026-08-26 02:33:55 +0530 |
|---|---|---|
| committer | Martin K. Petersen (Oracle) <mkp@kernel.org> | 2026-09-09 22:08:15 -0400 |
| commit | 896abdd4d81f40575b05d593f7fe004935a6cf97 (patch) | |
| tree | ee8432b006f11d89958665a19fc1565e3d3b52bf | |
| parent | cee9395acd8043be0644b25c34bfa86623f2b935 (diff) | |
| download | linux-next-896abdd4d81f40575b05d593f7fe004935a6cf97.tar.gz linux-next-896abdd4d81f40575b05d593f7fe004935a6cf97.zip | |
scsi: mpi3mr: Fix buffer overflow in BSG passthrough request copy
The size of an incoming BSG request is checked using a variable that is
narrower than the field it is read from, so large values wrap and pass the
check. The copy that follows then uses the full value and writes past the
request buffer.
Widen the variable and copy only the amount that was checked.
Fixes: 506bc1a0d6ba ("scsi: mpi3mr: Add support for MPT commands")
Signed-off-by: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
Link: https://patch.msgid.link/20260825210411.301535-2-chandrakanth.patil@broadcom.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
| -rw-r--r-- | drivers/scsi/mpi3mr/mpi3mr_app.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/scsi/mpi3mr/mpi3mr_app.c b/drivers/scsi/mpi3mr/mpi3mr_app.c index 1353a8ff9c85..8e5d24793efd 100644 --- a/drivers/scsi/mpi3mr/mpi3mr_app.c +++ b/drivers/scsi/mpi3mr/mpi3mr_app.c @@ -2384,7 +2384,7 @@ static long mpi3mr_bsg_process_mpt_cmds(struct bsg_job *job) long rval = -EINVAL; struct mpi3mr_ioc *mrioc = NULL; u8 *mpi_req = NULL, *sense_buff_k = NULL; - u8 mpi_msg_size = 0; + u32 mpi_msg_size = 0; struct mpi3mr_bsg_packet *bsg_req = NULL; struct mpi3mr_bsg_mptcmd *karg; struct mpi3mr_buf_entry *buf_entries = NULL; @@ -2538,7 +2538,7 @@ static long mpi3mr_bsg_process_mpt_cmds(struct bsg_job *job) rval = -EINVAL; goto out; } - memcpy(mpi_req, sgl_iter, buf_entries->buf_len); + memcpy(mpi_req, sgl_iter, mpi_msg_size); break; default: invalid_be = 1; |