diff options
| author | Chandrakanth Patil <chandrakanth.patil@broadcom.com> | 2026-08-26 02:33:56 +0530 |
|---|---|---|
| committer | Martin K. Petersen (Oracle) <mkp@kernel.org> | 2026-09-09 22:08:15 -0400 |
| commit | 9fac4cbd66d852958e8a8d0952eb57f8554ce83b (patch) | |
| tree | 10c33f14ae5235371536586ae58205bef9c98064 | |
| parent | 896abdd4d81f40575b05d593f7fe004935a6cf97 (diff) | |
| download | linux-next-9fac4cbd66d852958e8a8d0952eb57f8554ce83b.tar.gz linux-next-9fac4cbd66d852958e8a8d0952eb57f8554ce83b.zip | |
scsi: mpi3mr: Fix out-of-bounds read when copying BSG MPI requests
The MPI request is copied out of the caller supplied payload without first
checking that the requested amount is actually present, so the copy can
read past the end of the payload buffer.
Check the range before copying.
Fixes: 506bc1a0d6ba ("scsi: mpi3mr: Add support for MPT commands")
Signed-off-by: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
Link: https://patch.msgid.link/20260825210411.301535-3-chandrakanth.patil@broadcom.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
| -rw-r--r-- | drivers/scsi/mpi3mr/mpi3mr_app.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/drivers/scsi/mpi3mr/mpi3mr_app.c b/drivers/scsi/mpi3mr/mpi3mr_app.c index 8e5d24793efd..1cd1c38dcd56 100644 --- a/drivers/scsi/mpi3mr/mpi3mr_app.c +++ b/drivers/scsi/mpi3mr/mpi3mr_app.c @@ -2538,6 +2538,14 @@ static long mpi3mr_bsg_process_mpt_cmds(struct bsg_job *job) rval = -EINVAL; goto out; } + if (sgl_iter + mpi_msg_size > + dout_buf + job->request_payload.payload_len) { + dprint_bsg_err(mrioc, "%s: MPI request buf exceeds dout_buf\n", + __func__); + mutex_unlock(&mrioc->bsg_cmds.mutex); + rval = -EINVAL; + goto out; + } memcpy(mpi_req, sgl_iter, mpi_msg_size); break; default: |