]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
scsi: target: sbp: Potential integer overflow in sbp_make_tpg()
authorReBeating <rebeating@163.com>
Fri, 26 Dec 2025 03:19:36 +0000 (11:19 +0800)
committerMartin K. Petersen <martin.petersen@oracle.com>
Sun, 4 Jan 2026 20:44:17 +0000 (15:44 -0500)
commit8e8e8e7e8406e96a0189e116eb04f67f776f947f
tree1eb26d6637b57e330218f47fef0f79a5c8c99bcf
parent8334f93075dce0a4536c096a7d471ef90506a7a4
scsi: target: sbp: Potential integer overflow in sbp_make_tpg()

The variable tpgt in sbp_make_tpg() is defined as unsigned long and is
assigned to tpgt->tport_tpgt, which is defined as u16. This may cause an
integer overflow when tpgt is greater than USHRT_MAX (65535). I haven't
tried to trigger it myself, but it is possible to trigger it by calling
sbp_make_tpg() with a large value for tpgt.

Modify the type of tpgt to match tpgt->tport_tpgt and adjusted the
relevant code accordingly.

This patch is similar to commit 59c816c1f24d ("vhost/scsi: potential
memory corruption").

Signed-off-by: ReBeating <rebeating@163.com>
Link: https://patch.msgid.link/20251226031936.852-1-rebeating@163.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
drivers/target/sbp/sbp_target.c