[PATCH] scsi: qla2xxx: sanitize payload size to prevent member overflow

[PATCH] scsi: qla2xxx: sanitize payload size to prevent member overflow

[Jiasheng Jiang]

In qla27xx_copy_fpin_pkt() and qla27xx_copy_multiple_pkt(), the
frame_size reported by firmware is used to calculate the copy length
into item->iocb. However, the iocb member is defined as a fixed-size
64-byte array within struct purex_item.

If the reported frame_size exceeds 64 bytes, subsequent memcpy calls
will overflow the iocb member boundary. While extra memory might be
allocated, this cross-member write is unsafe and triggers warnings
under CONFIG_FORTIFY_SOURCE.

Fix this by capping total_bytes to the size of the iocb member (64 bytes)
before allocation and copying. This ensures all copies remain within
the bounds of the destination structure member.

Fixes: 875386b98857 ("scsi: qla2xxx: Add Unsolicited LS Request and Response Support for NVMe")
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
---
 drivers/scsi/qla2xxx/qla_isr.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index a3971afc2dd1..a04a5aa0d005 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -878,6 +878,9 @@ qla27xx_copy_multiple_pkt(struct scsi_qla_host *vha, void **pkt,
 		payload_size = sizeof(purex->els_frame_payload);
 	}
 
+	if (total_bytes > sizeof(item->iocb.iocb))
+		total_bytes = sizeof(item->iocb.iocb);
+
 	pending_bytes = total_bytes;
 	no_bytes = (pending_bytes > payload_size) ? payload_size :
 		   pending_bytes;
@@ -1163,6 +1166,10 @@ qla27xx_copy_fpin_pkt(struct scsi_qla_host *vha, void **pkt,
 
 	total_bytes = (le16_to_cpu(purex->frame_size) & 0x0FFF)
 	    - PURX_ELS_HEADER_SIZE;
+
+	if (total_bytes > sizeof(item->iocb.iocb))
+		total_bytes = sizeof(item->iocb.iocb);
+
 	pending_bytes = total_bytes;
 	entry_count = entry_count_remaining = purex->entry_count;
 	no_bytes = (pending_bytes > sizeof(purex->els_frame_payload))  ?
-- 
2.25.1

Re: [PATCH] scsi: qla2xxx: sanitize payload size to prevent member overflow

[Himanshu Madhani]

On 1/6/26 12:53 PM, Jiasheng Jiang wrote:
> In qla27xx_copy_fpin_pkt() and qla27xx_copy_multiple_pkt(), the
> frame_size reported by firmware is used to calculate the copy length
> into item->iocb. However, the iocb member is defined as a fixed-size
> 64-byte array within struct purex_item.
> 
> If the reported frame_size exceeds 64 bytes, subsequent memcpy calls
> will overflow the iocb member boundary. While extra memory might be
> allocated, this cross-member write is unsafe and triggers warnings
> under CONFIG_FORTIFY_SOURCE.
> 
> Fix this by capping total_bytes to the size of the iocb member (64 bytes)
> before allocation and copying. This ensures all copies remain within
> the bounds of the destination structure member.
> 
> Fixes: 875386b98857 ("scsi: qla2xxx: Add Unsolicited LS Request and Response Support for NVMe")
> Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
> ---
>   drivers/scsi/qla2xxx/qla_isr.c | 7 +++++++
>   1 file changed, 7 insertions(+)
> 
> diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
> index a3971afc2dd1..a04a5aa0d005 100644
> --- a/drivers/scsi/qla2xxx/qla_isr.c
> +++ b/drivers/scsi/qla2xxx/qla_isr.c
> @@ -878,6 +878,9 @@ qla27xx_copy_multiple_pkt(struct scsi_qla_host *vha, void **pkt,
>   		payload_size = sizeof(purex->els_frame_payload);
>   	}
>   
> +	if (total_bytes > sizeof(item->iocb.iocb))
> +		total_bytes = sizeof(item->iocb.iocb);
> +
>   	pending_bytes = total_bytes;
>   	no_bytes = (pending_bytes > payload_size) ? payload_size :
>   		   pending_bytes;
> @@ -1163,6 +1166,10 @@ qla27xx_copy_fpin_pkt(struct scsi_qla_host *vha, void **pkt,
>   
>   	total_bytes = (le16_to_cpu(purex->frame_size) & 0x0FFF)
>   	    - PURX_ELS_HEADER_SIZE;
> +
> +	if (total_bytes > sizeof(item->iocb.iocb))
> +		total_bytes = sizeof(item->iocb.iocb);
> +
>   	pending_bytes = total_bytes;
>   	entry_count = entry_count_remaining = purex->entry_count;
>   	no_bytes = (pending_bytes > sizeof(purex->els_frame_payload))  ?


This looks fine.

Reviewed-by: Himanshu Madhani <hmadhani2024@gmail.com>

---
Himanshu Madhani