Skip to content

Commit 6e93f1e

Browse files
Chandrakanth Patilroot
authored andcommitted
scsi: mpt3sas: Fix buffer overflow in mpt3sas_send_mctp_passthru_req()
JIRA: https://issues.redhat.com/browse/RHEL-81907 The "sz" argument in mpt3sas_check_cmd_timeout() is the number of u32, not the number of bytes. We dump that many u32 values to dmesg. Passing the number of bytes will lead to a read overflow. Divide by 4 to get the correct value. Fixes: c72be4b ("scsi: mpt3sas: Add support for MCTP Passthrough commands") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://lore.kernel.org/r/02b0d4ff-961c-49ae-921a-5cc469edf93c@stanley.mountain Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> (cherry picked from commit 0711f19) Signed-off-by: Chandrakanth Patil <chanpati@redhat.com>
1 parent 3408541 commit 6e93f1e

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

drivers/scsi/mpt3sas/mpt3sas_ctl.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3017,7 +3017,7 @@ int mpt3sas_send_mctp_passthru_req(struct mpt3_passthru_command *command)
30173017
if (!(ioc->ctl_cmds.status & MPT3_CMD_COMPLETE)) {
30183018
mpt3sas_check_cmd_timeout(ioc,
30193019
ioc->ctl_cmds.status, mpi_request,
3020-
sizeof(Mpi26MctpPassthroughRequest_t), issue_reset);
3020+
sizeof(Mpi26MctpPassthroughRequest_t) / 4, issue_reset);
30213021
goto issue_host_reset;
30223022
}
30233023

0 commit comments

Comments
 (0)