On Wed, Apr 10, 2024 at 12:59 AM Bart Van Assche <bvanassche@xxxxxxx> wrote: > > On 4/9/24 05:51, Sam Sun wrote: > > We further analyzed the root cause of this bug. In function > > sg_build_indirect of drivers/scsi/sg.c, variable order of line 1900 is > > calculated out using get_order(num), and num comes from > > scatter_elem_sz. If scatter_elem_sz is equal or below zero, the order > > returned will be 52, so that PAGE_SHIFT + order is 64, which is larger > > than 32 bits int range, causing shift-out-of bound. This bug is tested > > and still remains in the latest upstream linux (6.9-rc3). > > If you have any questions, please contact us. > > Thank you for having root-caused this issue and also for having shared > your root-cause analysis. Do you perhaps plan to post a patch that fixes > this issue? > > Thanks, > > Bart. > Sure, I am glad to help! But it is my first time submitting a patch, I need to find some instructions. I would appreciate if you could help me out. Also, I need to double check the patch to avoid introducing a new one. It might take some time. Best, Yue
