[<prev] [next>] [day] [month] [year] [list]
Message-ID: <aNvPMet7TPtM9CY1@stanley.mountain>
Date: Tue, 30 Sep 2025 15:38:09 +0300
From: Dan Carpenter <dan.carpenter@...aro.org>
To: Robert Love <robert.w.love@...el.com>
Cc: Hannes Reinecke <hare@...e.de>,
"James E.J. Bottomley" <James.Bottomley@...senpartnership.com>,
"Martin K. Petersen" <martin.petersen@...cle.com>,
linux-scsi@...r.kernel.org, linux-kernel@...r.kernel.org,
kernel-janitors@...r.kernel.org
Subject: [PATCH] scsi: libfc: Prevent integer overflow in fc_fcp_recv_data()
The "offset" comes from the skb->data that we received. Here the code is
verifying that "offset + len" is within bounds however it does not take
integer overflows into account. Use size_add() to be safe.
This would only be an issue on 32bit systems which are probably a very
small percent of the users. Still, it's worth fixing just for
correctness sake.
Fixes: 42e9a92fe6a9 ("[SCSI] libfc: A modular Fibre Channel library")
Signed-off-by: Dan Carpenter <dan.carpenter@...aro.org>
---
drivers/scsi/libfc/fc_fcp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/libfc/fc_fcp.c b/drivers/scsi/libfc/fc_fcp.c
index 16d0f02af1e4..31d08c115521 100644
--- a/drivers/scsi/libfc/fc_fcp.c
+++ b/drivers/scsi/libfc/fc_fcp.c
@@ -503,7 +503,7 @@ static void fc_fcp_recv_data(struct fc_fcp_pkt *fsp, struct fc_frame *fp)
host_bcode = FC_ERROR;
goto err;
}
- if (offset + len > fsp->data_len) {
+ if (size_add(offset, len) > fsp->data_len) {
/* this should never happen */
if ((fr_flags(fp) & FCPHF_CRC_UNCHECKED) &&
fc_frame_crc_check(fp))
--
2.51.0
Powered by blists - more mailing lists