From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dl1-f46.google.com (mail-dl1-f46.google.com [74.125.82.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EB80B264612 for ; Mon, 12 Jan 2026 22:02:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.46 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768255334; cv=none; b=AF2kw0vcGWyTaa5G0Zm7AM7QfPh0pxfk6qJrlqTtZmdL1do9jI9xAKzK0y7CAtrDUC6inO9RoZC/faVMw+DXFr/KRNe/er/mdmkE0RBIgOO7rTuEil3PF3t0xTgZtS80theBeM0j41PSXkuYWVI9NPC+PRBvSKikIRC75YS9QOQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768255334; c=relaxed/simple; bh=uNPEhooWM7nMuk8BxxGPe54nAPEwblBc6LywLIxFkiU=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=L8FWByaQcoiaM2lEdZ8S6OsNf1pBtGsFKR2q6PJAGl85xNdkl1Khlh2uxdmDgXsKkmYKIEEgUj228xImhwbE8p8PWWpol7EzERA9o+p49W0iljHe4L9tSxFYf1EEepPwwtruLMXfZomlS6O4khW0dNOLEiEBTHefAJVaBykFlQg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=cavAcKXr; arc=none smtp.client-ip=74.125.82.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="cavAcKXr" Received: by mail-dl1-f46.google.com with SMTP id a92af1059eb24-121b14efeb8so2012625c88.1 for ; Mon, 12 Jan 2026 14:02:12 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1768255332; x=1768860132; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:organization:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:from:to:cc:subject:date:message-id:reply-to; bh=Mgr+mizZlg6mGy3rYGsy0TuYZ7s7SAHVl0VF2n3R/X0=; b=cavAcKXr4RhENP4+kcXi3QNDon5jrwKbuQYM7MojD17SiovowdUh4Ii3CMA0rQlZwH F/MbD159R/Li/jG9pMSAt/axy4CYLm/Xygk1QmAUw5aXSJZiXVgBfneY9Th3loyvFB57 Q7O6AobZKqccHUXc80/D8zPj6Qy28VDKov4HxD633xakwk4WEbctwMcsOnkCvJH5+4Ib eOkN2yz7zIfxQhsBtx5G29HhU13Ls3LIdOuUFfrGFR0rf9rzHnrZ2iwEZGNIdZW7kV/I sBS3EkY0KQS6NOGSd0LfFy7Zb5tKM+tAM0g+6uMsImulwMrVntddVUuMC4gMSxTyxYw+ zh4w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1768255332; x=1768860132; h=content-transfer-encoding:in-reply-to:organization:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=Mgr+mizZlg6mGy3rYGsy0TuYZ7s7SAHVl0VF2n3R/X0=; b=w0iT9p6uB6v7QMYWz5ELbe0h0H1dqiCJFPk240uGq4XnzVrORQI2E6F/Y2s6TZZ0TH +hjMyFhLU8q/x/aXzfm+ReBmL2TFh0cJDPDzlJ0yE5HQ1cxl2kjJuIaXvNKqOiz8Egpl 262mZpfk2hogpii8clynmpj0anxyZt19U+JJ77sdRzY9H0dJ9zdmtLQymH8fr9yDyU05 PoGWPoioYFdI6EaQWI/vIUJ16KM0SMi+zzlriAL6tZNIEe7vy0qOIGj8U5wx99ep5b0w QiFblPnf/PYtP8ZCAXjxr5PUcxoLuqNeYp5Dv/izueZtQWC9pHjn00fIcnxEOae7Fg6g CSzQ== X-Forwarded-Encrypted: i=1; AJvYcCUdr028gO3AFWn5Kn+8AqSxiT6Qs4o8qNH4sZXBEiO8O3QqQ70Hij2PNOk8Xq8aZO2Rr6/doNTk32ydrA4=@vger.kernel.org X-Gm-Message-State: AOJu0YyKv9+G4niSweHlwuLswoDH0L/QEfNgVs0Mmom01NUa8oxCHdoj n7GtETjV3uiN9edF+lKEuIhVQGWT/8xPDO+5aM+Sbc92WN5SCR2tCfedY5EA7YzV X-Gm-Gg: AY/fxX75dxP3ygAIf9HbJIkR2+3xi/sjqFHROv6oekDvhH71Hsx7ZZ+SMuxflVHCdmv eGYrlLOqyv80M/zRe6179xkVmEmk+IMNwiRSyFGgshrJil0XyRuQ5OJI/DxJR42kGm4rkG1BTXH JB+Fi8L2o1GM7WCIHc+dIiKMEx2xcG40tt3+NBiAmW6cKgC1X3jtXvXf9fq7QSxp7K0S3BIFFAD de+49NL1kzPZIZShLndn+oThjwNrUKkVVCQlRomVxgzjUjISPpB32hX7wV4dCzdqAYz4kFYwOpO p+TZig+9Ux4GTeh31py2jBwB4GxUAOhFTtNBqfhCpebYIYoBOk9au3xj6FHgTX4BVAne26d1roy Jxe9dukHSplOCmRYhNZGMIJUiZgTzX1Zai7gv6t8zv0tqiGoYXGFgv0S73MQkZ7n2Go1pBlX+S+ wYXM6oFC7NsB+rhmAoM0C4mvfnLcF9imO3Vt0dYef+kJzCejPSnyiLpCN2aybtRtJBQg== X-Google-Smtp-Source: AGHT+IHP8nj7tEMqqDVdfJUkFuriKZ8eZm2ukt0pxr6RnIKOuuV3l2nrlktNGSDsjdH2YL6e4MamXw== X-Received: by 2002:a05:7022:41a0:b0:11b:7970:ea3f with SMTP id a92af1059eb24-121f8b4e293mr21232191c88.25.1768255331762; Mon, 12 Jan 2026 14:02:11 -0800 (PST) Received: from [192.168.1.59] (c-24-5-244-16.hsd1.ca.comcast.net. [24.5.244.16]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-2b17078dd84sm16268238eec.17.2026.01.12.14.02.10 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 12 Jan 2026 14:02:11 -0800 (PST) Message-ID: Date: Mon, 12 Jan 2026 14:02:09 -0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] scsi: qla2xxx: sanitize payload size to prevent member overflow To: Jiasheng Jiang , Nilesh Javali , GR-QLogic-Storage-Upstream@marvell.com, "James E . J . Bottomley" , "Martin K . Petersen" Cc: Himanshu Madhani , Manish Rangankar , linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org References: <20260106205344.18031-1-jiashengjiangcool@gmail.com> Content-Language: en-US From: Himanshu Madhani Organization: Upstream Kernel In-Reply-To: <20260106205344.18031-1-jiashengjiangcool@gmail.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 1/6/26 12:53 PM, Jiasheng Jiang wrote: > In qla27xx_copy_fpin_pkt() and qla27xx_copy_multiple_pkt(), the > frame_size reported by firmware is used to calculate the copy length > into item->iocb. However, the iocb member is defined as a fixed-size > 64-byte array within struct purex_item. > > If the reported frame_size exceeds 64 bytes, subsequent memcpy calls > will overflow the iocb member boundary. While extra memory might be > allocated, this cross-member write is unsafe and triggers warnings > under CONFIG_FORTIFY_SOURCE. > > Fix this by capping total_bytes to the size of the iocb member (64 bytes) > before allocation and copying. This ensures all copies remain within > the bounds of the destination structure member. > > Fixes: 875386b98857 ("scsi: qla2xxx: Add Unsolicited LS Request and Response Support for NVMe") > Signed-off-by: Jiasheng Jiang > --- > drivers/scsi/qla2xxx/qla_isr.c | 7 +++++++ > 1 file changed, 7 insertions(+) > > diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c > index a3971afc2dd1..a04a5aa0d005 100644 > --- a/drivers/scsi/qla2xxx/qla_isr.c > +++ b/drivers/scsi/qla2xxx/qla_isr.c > @@ -878,6 +878,9 @@ qla27xx_copy_multiple_pkt(struct scsi_qla_host *vha, void **pkt, > payload_size = sizeof(purex->els_frame_payload); > } > > + if (total_bytes > sizeof(item->iocb.iocb)) > + total_bytes = sizeof(item->iocb.iocb); > + > pending_bytes = total_bytes; > no_bytes = (pending_bytes > payload_size) ? payload_size : > pending_bytes; > @@ -1163,6 +1166,10 @@ qla27xx_copy_fpin_pkt(struct scsi_qla_host *vha, void **pkt, > > total_bytes = (le16_to_cpu(purex->frame_size) & 0x0FFF) > - PURX_ELS_HEADER_SIZE; > + > + if (total_bytes > sizeof(item->iocb.iocb)) > + total_bytes = sizeof(item->iocb.iocb); > + > pending_bytes = total_bytes; > entry_count = entry_count_remaining = purex->entry_count; > no_bytes = (pending_bytes > sizeof(purex->els_frame_payload)) ? This looks fine. Reviewed-by: Himanshu Madhani --- Himanshu Madhani