On Thu, Jan 26, 2023 at 11:35 PM Shin'ichiro Kawasaki
<shinichiro.kawasaki@xxxxxxx> wrote:
>
> The function mpi3mr_get_all_tgt_info calculates min_entrylen which holds
> the valid entry length in alltgt_info. However, it does not refer
> min_entrylen when it calls sg_copy_from_buffer to copy the valid entries
> from alltgt_info to job->request_payload. Instead, it specifies the
> payload length which is larger than the alltgt_info size, then it causes
> "BUG: KASAN: slab-out-of-bounds". Fix the BUG by specifying the correct
> length referring the calculated min_entrylen.
>>both this and the first patch could have been merged. We will do some more cleanup on this function and provide a new patch, we can hold 1 and 2 for now.
>
> Fixes: f5e6d5a34376 ("scsi: mpi3mr: Add support for driver commands")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@xxxxxxx>
> ---
> drivers/scsi/mpi3mr/mpi3mr_app.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/scsi/mpi3mr/mpi3mr_app.c b/drivers/scsi/mpi3mr/mpi3mr_app.c
> index 49916ae617e5..7fb9505723cf 100644
> --- a/drivers/scsi/mpi3mr/mpi3mr_app.c
> +++ b/drivers/scsi/mpi3mr/mpi3mr_app.c
> @@ -359,7 +359,7 @@ static long mpi3mr_get_all_tgt_info(struct mpi3mr_ioc *mrioc,
>
> sg_copy_from_buffer(job->request_payload.sg_list,
> job->request_payload.sg_cnt,
> - alltgt_info, job->request_payload.payload_len);
> + alltgt_info, sizeof(*alltgt_info) + min_entrylen);
> rval = 0;
> out:
> kfree(alltgt_info);
> --
> 2.38.1
>
--
This electronic communication and the information and any files transmitted
with it, or attached to it, are confidential and are intended solely for
the use of the individual or entity to whom it is addressed and may contain
information that is confidential, legally privileged, protected by privacy
laws, or otherwise restricted from disclosure to anyone else. If you are
not the intended recipient or the person responsible for delivering the
e-mail to the intended recipient, you are hereby notified that any use,
copying, distributing, dissemination, forwarding, printing, or copying of
this e-mail is strictly prohibited. If you received this e-mail in error,
please return the e-mail to the sender, delete it from your computer, and
destroy any printed copy of it.
Attachment:
smime.p7s
Description: S/MIME Cryptographic Signature
