projects / thirdparty / kernel / stable-queue.git / blame
| Commit | Line | Data |
|---|---|---|
| 299da1b8 SL |
1 | From c1b2ef3b46e0e00404c208e748f366c337108fde Mon Sep 17 00:00:00 2001 |
| 2 | From: Sasha Levin <sashal@kernel.org> | |
| 3 | Date: Tue, 2 Apr 2024 12:56:54 +0300 | |
| 4 | Subject: scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() | |
| 5 | ||
| 6 | From: Dan Carpenter <dan.carpenter@linaro.org> | |
| 7 | ||
| 8 | [ Upstream commit 4406e4176f47177f5e51b4cc7e6a7a2ff3dbfbbd ] | |
| 9 | ||
| 10 | The app_reply->elem[] array is allocated earlier in this function and it | |
| 11 | has app_req.num_ports elements. Thus this > comparison needs to be >= to | |
| 12 | prevent memory corruption. | |
| 13 | ||
| 14 | Fixes: 7878f22a2e03 ("scsi: qla2xxx: edif: Add getfcinfo and statistic bsgs") | |
| 15 | Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> | |
| 16 | Link: https://lore.kernel.org/r/5c125b2f-92dd-412b-9b6f-fc3a3207bd60@moroto.mountain | |
| 17 | Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com> | |
| 18 | Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> | |
| 19 | Signed-off-by: Sasha Levin <sashal@kernel.org> | |
| 20 | --- | |
| 21 | drivers/scsi/qla2xxx/qla_edif.c | 2 +- | |
| 22 | 1 file changed, 1 insertion(+), 1 deletion(-) | |
| 23 | ||
| 24 | diff --git a/drivers/scsi/qla2xxx/qla_edif.c b/drivers/scsi/qla2xxx/qla_edif.c | |
| 25 | index 40a03f9c2d21f..ac702f74dd984 100644 | |
| 26 | --- a/drivers/scsi/qla2xxx/qla_edif.c | |
| 27 | +++ b/drivers/scsi/qla2xxx/qla_edif.c | |
| 28 | @@ -1012,7 +1012,7 @@ qla_edif_app_getstats(scsi_qla_host_t *vha, struct bsg_job *bsg_job) | |
| 29 | ||
| 30 | list_for_each_entry_safe(fcport, tf, &vha->vp_fcports, list) { | |
| 31 | if (fcport->edif.enable) { | |
| 32 | - if (pcnt > app_req.num_ports) | |
| 33 | + if (pcnt >= app_req.num_ports) | |
| 34 | break; | |
| 35 | ||
| 36 | app_reply->elem[pcnt].rekey_count = | |
| 37 | -- | |
| 38 | 2.43.0 | |
| 39 |