diff options
| author | Chandrakanth Patil <chandrakanth.patil@broadcom.com> | 2026-08-26 02:33:59 +0530 |
|---|---|---|
| committer | Martin K. Petersen (Oracle) <mkp@kernel.org> | 2026-09-09 22:08:15 -0400 |
| commit | 9ff1af19c488efad66f2b803eefa0abd5fdac8f4 (patch) | |
| tree | c03d6c076afd8fcb904f91f71df139189092761e | |
| parent | f0ec04bdf6156ed2ae7d86a8819dafdd9383b705 (diff) | |
| download | linux-next-9ff1af19c488efad66f2b803eefa0abd5fdac8f4.tar.gz linux-next-9ff1af19c488efad66f2b803eefa0abd5fdac8f4.zip | |
scsi: mpi3mr: Fix buffer overflow when caching log data
Each log data slot holds a header followed by the payload, but the copy was
sized against the whole slot and so wrote one header length past the end of
it. Subtracting the header on its own is not enough either, because the
entry size is derived from the controller reply size and can be smaller
than the header.
Work out the payload room first and clamp the copy to it.
Fixes: 43ca11005098 ("scsi: mpi3mr: Add support for PEL commands")
Signed-off-by: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
Link: https://patch.msgid.link/20260825210411.301535-6-chandrakanth.patil@broadcom.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
| -rw-r--r-- | drivers/scsi/mpi3mr/mpi3mr_app.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/drivers/scsi/mpi3mr/mpi3mr_app.c b/drivers/scsi/mpi3mr/mpi3mr_app.c index 94b992acb233..cd772b2cb98a 100644 --- a/drivers/scsi/mpi3mr/mpi3mr_app.c +++ b/drivers/scsi/mpi3mr/mpi3mr_app.c @@ -2947,7 +2947,8 @@ out: void mpi3mr_app_save_logdata_th(struct mpi3mr_ioc *mrioc, char *event_data, u16 event_data_size) { - u32 index = mrioc->logdata_buf_idx, sz; + u32 index = mrioc->logdata_buf_idx; + size_t entry_payload_len, sz; struct mpi3mr_logdata_entry *entry; if (!(mrioc->logdata_buf)) @@ -2956,7 +2957,12 @@ void mpi3mr_app_save_logdata_th(struct mpi3mr_ioc *mrioc, char *event_data, entry = (struct mpi3mr_logdata_entry *) (mrioc->logdata_buf + (index * mrioc->logdata_entry_sz)); entry->valid_entry = 1; - sz = min(mrioc->logdata_entry_sz, event_data_size); + if (mrioc->logdata_entry_sz > MPI3MR_BSG_LOGDATA_ENTRY_HEADER_SZ) + entry_payload_len = (size_t)mrioc->logdata_entry_sz - + MPI3MR_BSG_LOGDATA_ENTRY_HEADER_SZ; + else + entry_payload_len = 0; + sz = min_t(size_t, entry_payload_len, event_data_size); memcpy(entry->data, event_data, sz); mrioc->logdata_buf_idx = ((++index) % MPI3MR_BSG_LOGDATA_MAX_ENTRIES); |