scsi: mpi3mr: Validate reply frame size bounds

Firmware provides reply_frame_size in dwords, which the driver multiplies
by 4 to compute facts.reply_sz (u16). If the reported size exceeds U16_MAX
/ 4, the multiplication overflows u16 before assignment, causing
under-allocated DMA reply buffers.

Furthermore, several paths assume a minimal reply frame size:

 - logdata_entry_sz calculations underflow or hit zero when reply_sz <= 20
   bytes, leading to zero-size allocations and divide-by-zero crashes.

 - Unsolicited status descriptors and fixed replies (such as struct
   mpi3_iounit_control_reply, 64 bytes) require at least 16 dwords.

Validate reply_frame_size in mpi3mr_issue_iocfacts() to ensure it is within
[16, U16_MAX / 4] dwords before processing facts data.

Fixes: 824a156633df ("scsi: mpi3mr: Base driver code")
Cc: stable@vger.kernel.org
Signed-off-by: Milan P. Gandhi <mgandhi@redhat.com>
Link: https://patch.msgid.link/20261105122401.266559-1-mgandhi@redhat.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>

0 files changed, 0 insertions, 0 deletions