diff options
| author | Chandrakanth Patil <chandrakanth.patil@broadcom.com> | 2026-08-26 02:34:00 +0530 |
|---|---|---|
| committer | Martin K. Petersen (Oracle) <mkp@kernel.org> | 2026-09-09 22:08:15 -0400 |
| commit | bcf0a5bed59acd5ae19d80e1f617c1a5b355af0b (patch) | |
| tree | e47e7b6a8b5e00c209e557f488d0820cf044d23d /tools/perf/scripts/python | |
| parent | 9ff1af19c488efad66f2b803eefa0abd5fdac8f4 (diff) | |
| download | linux-next-bcf0a5bed59acd5ae19d80e1f617c1a5b355af0b.tar.gz linux-next-bcf0a5bed59acd5ae19d80e1f617c1a5b355af0b.zip | |
scsi: mpi3mr: Fix out-of-bounds reply frame access
The reply frame address reported on completion is only checked against the
start and the end of the pool. An address near the top can pass the check
while leaving less than a full frame, and an unaligned one resolves into
the middle of a frame instead of the start of one.
Require a whole frame to fit and the address to be frame aligned.
Fixes: 824a156633df ("scsi: mpi3mr: Base driver code")
Signed-off-by: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
Link: https://patch.msgid.link/20260825210411.301535-7-chandrakanth.patil@broadcom.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions