linux-kernel - Re: [PATCH] scsi: qla2xxx: sanitize payload size to prevent member overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <f0d97bec-3eb9-4a80-b179-fb29353f471c@gmail.com>
Date: Mon, 12 Jan 2026 14:02:09 -0800
From: Himanshu Madhani <hmadhani2024@...il.com>
To: Jiasheng Jiang <jiashengjiangcool@...il.com>,
 Nilesh Javali <njavali@...vell.com>, GR-QLogic-Storage-Upstream@...vell.com,
 "James E . J . Bottomley" <James.Bottomley@...senPartnership.com>,
 "Martin K . Petersen" <martin.petersen@...cle.com>
Cc: Himanshu Madhani <himanshu.madhani@...cle.com>,
 Manish Rangankar <mrangankar@...vell.com>, linux-scsi@...r.kernel.org,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH] scsi: qla2xxx: sanitize payload size to prevent member
 overflow

On 1/6/26 12:53 PM, Jiasheng Jiang wrote:
> In qla27xx_copy_fpin_pkt() and qla27xx_copy_multiple_pkt(), the
> frame_size reported by firmware is used to calculate the copy length
> into item->iocb. However, the iocb member is defined as a fixed-size
> 64-byte array within struct purex_item.
> 
> If the reported frame_size exceeds 64 bytes, subsequent memcpy calls
> will overflow the iocb member boundary. While extra memory might be
> allocated, this cross-member write is unsafe and triggers warnings
> under CONFIG_FORTIFY_SOURCE.
> 
> Fix this by capping total_bytes to the size of the iocb member (64 bytes)
> before allocation and copying. This ensures all copies remain within
> the bounds of the destination structure member.
> 
> Fixes: 875386b98857 ("scsi: qla2xxx: Add Unsolicited LS Request and Response Support for NVMe")
> Signed-off-by: Jiasheng Jiang <jiashengjiangcool@...il.com>
> ---
>   drivers/scsi/qla2xxx/qla_isr.c | 7 +++++++
>   1 file changed, 7 insertions(+)
> 
> diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
> index a3971afc2dd1..a04a5aa0d005 100644
> --- a/drivers/scsi/qla2xxx/qla_isr.c
> +++ b/drivers/scsi/qla2xxx/qla_isr.c
> @@ -878,6 +878,9 @@ qla27xx_copy_multiple_pkt(struct scsi_qla_host *vha, void **pkt,
>   		payload_size = sizeof(purex->els_frame_payload);
>   	}
>   
> +	if (total_bytes > sizeof(item->iocb.iocb))
> +		total_bytes = sizeof(item->iocb.iocb);
> +
>   	pending_bytes = total_bytes;
>   	no_bytes = (pending_bytes > payload_size) ? payload_size :
>   		   pending_bytes;
> @@ -1163,6 +1166,10 @@ qla27xx_copy_fpin_pkt(struct scsi_qla_host *vha, void **pkt,
>   
>   	total_bytes = (le16_to_cpu(purex->frame_size) & 0x0FFF)
>   	    - PURX_ELS_HEADER_SIZE;
> +
> +	if (total_bytes > sizeof(item->iocb.iocb))
> +		total_bytes = sizeof(item->iocb.iocb);
> +
>   	pending_bytes = total_bytes;
>   	entry_count = entry_count_remaining = purex->entry_count;
>   	no_bytes = (pending_bytes > sizeof(purex->els_frame_payload))  ?


This looks fine.

Reviewed-by: Himanshu Madhani <hmadhani2024@...il.com>

---
Himanshu Madhani