diff options
| author | Chandrakanth Patil <chandrakanth.patil@broadcom.com> | 2026-08-26 02:34:05 +0530 |
|---|---|---|
| committer | Martin K. Petersen (Oracle) <mkp@kernel.org> | 2026-09-09 22:08:16 -0400 |
| commit | 77554f01187d91c20f04d2a8e28270943ed64cca (patch) | |
| tree | 8cf5a56d129d0658b9cb76f327601b5930730568 /tools/perf/scripts/python | |
| parent | 9e220ce4bd0468e47cc9eea07e40799ebae6eda8 (diff) | |
| download | linux-next-77554f01187d91c20f04d2a8e28270943ed64cca.tar.gz linux-next-77554f01187d91c20f04d2a8e28270943ed64cca.zip | |
scsi: mpi3mr: Fix out-of-bounds read of event data
The event data length from the reply is used as is, both when caching log
data and when sizing the buffer handed to the bottom half. A length larger
than the frame makes both of them read past the end of it.
Clamp the length to what the frame can hold.
Fixes: 13ef29ea4aa0 ("scsi: mpi3mr: Add support for device add/remove event handling")
Fixes: d0d19250ed81 ("scsi: mpi3mr: Rename log data save helper to reflect threaded/BH context")
Signed-off-by: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
Link: https://patch.msgid.link/20260825210411.301535-12-chandrakanth.patil@broadcom.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions