mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-05-12 15:08:25 -04:00
Code Issues Packages Projects Releases Wiki Activity

scsi: mpt3sas: Fix buffer overflow in mpt3sas_send_mctp_passthru_req()

Browse Source 
The "sz" argument in mpt3sas_check_cmd_timeout() is the number of u32, not
the number of bytes.  We dump that many u32 values to dmesg.  Passing the
number of bytes will lead to a read overflow.  Divide by 4 to get the
correct value.

Fixes: c72be4b5bb ("scsi: mpt3sas: Add support for MCTP Passthrough commands")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/02b0d4ff-961c-49ae-921a-5cc469edf93c@stanley.mountain
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
This commit is contained in:
Dan Carpenter
2025-02-28 12:37:28 +03:00
committed by Martin K. Petersen
parent 8a9b76b7d9
commit 0711f1966a
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/scsi/mpt3sas/mpt3sas_ctl.c
View File

@@ -3017,7 +3017,7 @@ int mpt3sas_send_mctp_passthru_req(struct mpt3_passthru_command *command)
if (!(ioc->ctl_cmds.status & MPT3_CMD_COMPLETE)) {
mpt3sas_check_cmd_timeout(ioc,
ioc->ctl_cmds.status, mpi_request,
sizeof(Mpi26MctpPassthroughRequest_t), issue_reset);
sizeof(Mpi26MctpPassthroughRequest_t) / 4, issue_reset);
goto issue_host_reset;
}