On 4/9/24 05:51, Sam Sun wrote:
We further analyzed the root cause of this bug. In function sg_build_indirect of drivers/scsi/sg.c, variable order of line 1900 is calculated out using get_order(num), and num comes from scatter_elem_sz. If scatter_elem_sz is equal or below zero, the order returned will be 52, so that PAGE_SHIFT + order is 64, which is larger than 32 bits int range, causing shift-out-of bound. This bug is tested and still remains in the latest upstream linux (6.9-rc3). If you have any questions, please contact us.
Thank you for having root-caused this issue and also for having shared your root-cause analysis. Do you perhaps plan to post a patch that fixes this issue? Thanks, Bart.
