diff options
| author | Chandrakanth Patil <chandrakanth.patil@broadcom.com> | 2026-08-26 02:34:00 +0530 |
|---|---|---|
| committer | Martin K. Petersen (Oracle) <mkp@kernel.org> | 2026-09-09 22:08:15 -0400 |
| commit | bcf0a5bed59acd5ae19d80e1f617c1a5b355af0b (patch) | |
| tree | e47e7b6a8b5e00c209e557f488d0820cf044d23d | |
| parent | 9ff1af19c488efad66f2b803eefa0abd5fdac8f4 (diff) | |
| download | linux-next-bcf0a5bed59acd5ae19d80e1f617c1a5b355af0b.tar.gz linux-next-bcf0a5bed59acd5ae19d80e1f617c1a5b355af0b.zip | |
scsi: mpi3mr: Fix out-of-bounds reply frame access
The reply frame address reported on completion is only checked against the
start and the end of the pool. An address near the top can pass the check
while leaving less than a full frame, and an unaligned one resolves into
the middle of a frame instead of the start of one.
Require a whole frame to fit and the address to be frame aligned.
Fixes: 824a156633df ("scsi: mpi3mr: Base driver code")
Signed-off-by: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
Link: https://patch.msgid.link/20260825210411.301535-7-chandrakanth.patil@broadcom.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
| -rw-r--r-- | drivers/scsi/mpi3mr/mpi3mr_fw.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/drivers/scsi/mpi3mr/mpi3mr_fw.c b/drivers/scsi/mpi3mr/mpi3mr_fw.c index 681868716ebd..82fadb4d2b21 100644 --- a/drivers/scsi/mpi3mr/mpi3mr_fw.c +++ b/drivers/scsi/mpi3mr/mpi3mr_fw.c @@ -124,11 +124,16 @@ void mpi3mr_build_zero_len_sge(void *paddr) void *mpi3mr_get_reply_virt_addr(struct mpi3mr_ioc *mrioc, dma_addr_t phys_addr) { + u64 offset; + if (!phys_addr) return NULL; + offset = phys_addr - mrioc->reply_buf_dma; + if ((phys_addr < mrioc->reply_buf_dma) || - (phys_addr > mrioc->reply_buf_dma_max_address)) + (phys_addr > mrioc->reply_buf_dma_max_address - mrioc->reply_sz) || + do_div(offset, mrioc->reply_sz)) return NULL; return mrioc->reply_buf + (phys_addr - mrioc->reply_buf_dma); |