Commit 3668651d authored by Tomas Henzl's avatar Tomas Henzl Committed by Martin K. Petersen
Browse files

scsi: mpi3mr: Sanitise num_phys 



Information is stored in mr_sas_port->phy_mask, values larger then size of
this field shouldn't be allowed.

Signed-off-by: default avatarTomas Henzl <thenzl@redhat.com>
Link: https://lore.kernel.org/r/20240226151013.8653-1-thenzl@redhat.com


Acked-by: default avatarSathya Prakash Veerichetty <sathya.prakash@broadcom.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 40ae6a1e

drivers/scsi/mpi3mr/mpi3mr_transport.c

+10 −0
Original line number Diff line number Diff line
@@ -1355,11 +1355,21 @@ static struct mpi3mr_sas_port *mpi3mr_sas_port_add(struct mpi3mr_ioc *mrioc, 
	mpi3mr_sas_port_sanity_check(mrioc, mr_sas_node,

	    mr_sas_port->remote_identify.sas_address, hba_port);



	if (mr_sas_node->num_phys > sizeof(mr_sas_port->phy_mask) * 8)

		ioc_info(mrioc, "max port count %u could be too high\n",

		    mr_sas_node->num_phys);



	for (i = 0; i < mr_sas_node->num_phys; i++) {

		if ((mr_sas_node->phy[i].remote_identify.sas_address !=

		    mr_sas_port->remote_identify.sas_address) ||

		    (mr_sas_node->phy[i].hba_port != hba_port))

			continue;



		if (i > sizeof(mr_sas_port->phy_mask) * 8) {

			ioc_warn(mrioc, "skipping port %u, max allowed value is %lu\n",

			    i, sizeof(mr_sas_port->phy_mask) * 8);

			goto out_fail;

		}

		list_add_tail(&mr_sas_node->phy[i].port_siblings,

		    &mr_sas_port->phy_list);

		mr_sas_port->num_phys++;