Merge patch series "scsi: mpi3mr: Fix out-of-bounds accesses and reference leaks"

Chandrakanth Patil <chandrakanth.patil@broadcom.com> says:

This series contains a set of fixes for the mpi3mr driver:

 - Out-of-bounds accesses where values reported by the controller (device
   handles, phy numbers, topology event entry counts, reply and sense
   buffer addresses, event data lengths) are used to index arrays, derive
   pointers or size copies without being checked first

 - Out-of-bounds accesses in the BSG passthrough paths, from a request size
   held in too narrow a variable and from a copy made without checking the
   payload holds that much data

 - Target device reference leaks and an I/O block counter leak on error and
   teardown paths, the latter leaving a device blocked for I/O

 - A response buffer copied back to user space without being zeroed first,
   so its unwritten fields carry whatever the allocation held

 - A use-after-free and a NULL dereference around the firmware event
   workqueue during driver removal and PCI error recovery

Link: https://patch.msgid.link/20260825210411.301535-1-chandrakanth.patil@broadcom.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>

0 files changed, 0 insertions, 0 deletions