diff options
| author | Chandrakanth Patil <chandrakanth.patil@broadcom.com> | 2026-08-26 02:34:04 +0530 |
|---|---|---|
| committer | Martin K. Petersen (Oracle) <mkp@kernel.org> | 2026-09-09 22:08:16 -0400 |
| commit | 9e220ce4bd0468e47cc9eea07e40799ebae6eda8 (patch) | |
| tree | f5c6c7c2ee853947df195c2f939803a84f97831c /tools/perf/scripts/python | |
| parent | a04b0f3a17e32aa449fd896163a7b40efc29c4f5 (diff) | |
| download | linux-next-9e220ce4bd0468e47cc9eea07e40799ebae6eda8.tar.gz linux-next-9e220ce4bd0468e47cc9eea07e40799ebae6eda8.zip | |
scsi: mpi3mr: Fix out-of-bounds read in SAS topology change events
The number of entries in a SAS topology change event is used to walk the
entry array without being compared against the amount of event data that
was received, so the walk can run past the end of the buffer.
Work out how many entries the payload can hold and skip the event if it
claims more.
Fixes: 13ef29ea4aa0 ("scsi: mpi3mr: Add support for device add/remove event handling")
Signed-off-by: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
Link: https://patch.msgid.link/20260825210411.301535-11-chandrakanth.patil@broadcom.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions