diff options
| author | Tomas Henzl <thenzl@redhat.com> | 2024-02-26 16:10:13 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-07-11 12:49:09 +0200 |
| commit | 586b41060113ae43032ec6c4a16d518cef5da6e0 (patch) | |
| tree | 5dba197c0547d591a16fea18b3b319603b1b6d5d /drivers/scsi | |
| parent | 44958ca9e400f57bd0478115519ffc350fcee61e (diff) | |
| download | linux-rpi-586b41060113ae43032ec6c4a16d518cef5da6e0.tar.gz linux-rpi-586b41060113ae43032ec6c4a16d518cef5da6e0.tar.bz2 linux-rpi-586b41060113ae43032ec6c4a16d518cef5da6e0.zip | |
scsi: mpi3mr: Sanitise num_phys
[ Upstream commit 3668651def2c1622904e58b0280ee93121f2b10b ]
Information is stored in mr_sas_port->phy_mask, values larger then size of
this field shouldn't be allowed.
Signed-off-by: Tomas Henzl <thenzl@redhat.com>
Link: https://lore.kernel.org/r/20240226151013.8653-1-thenzl@redhat.com
Acked-by: Sathya Prakash Veerichetty <sathya.prakash@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/scsi')
| -rw-r--r-- | drivers/scsi/mpi3mr/mpi3mr_transport.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/drivers/scsi/mpi3mr/mpi3mr_transport.c b/drivers/scsi/mpi3mr/mpi3mr_transport.c index 82b55e955730..91c2f667a4c0 100644 --- a/drivers/scsi/mpi3mr/mpi3mr_transport.c +++ b/drivers/scsi/mpi3mr/mpi3mr_transport.c @@ -1355,11 +1355,21 @@ static struct mpi3mr_sas_port *mpi3mr_sas_port_add(struct mpi3mr_ioc *mrioc, mpi3mr_sas_port_sanity_check(mrioc, mr_sas_node, mr_sas_port->remote_identify.sas_address, hba_port); + if (mr_sas_node->num_phys > sizeof(mr_sas_port->phy_mask) * 8) + ioc_info(mrioc, "max port count %u could be too high\n", + mr_sas_node->num_phys); + for (i = 0; i < mr_sas_node->num_phys; i++) { if ((mr_sas_node->phy[i].remote_identify.sas_address != mr_sas_port->remote_identify.sas_address) || (mr_sas_node->phy[i].hba_port != hba_port)) continue; + + if (i > sizeof(mr_sas_port->phy_mask) * 8) { + ioc_warn(mrioc, "skipping port %u, max allowed value is %lu\n", + i, sizeof(mr_sas_port->phy_mask) * 8); + goto out_fail; + } list_add_tail(&mr_sas_node->phy[i].port_siblings, &mr_sas_port->phy_list); mr_sas_port->num_phys++; |