scsi: mpi3mr: Sanitise num_phys

Information is stored in mr_sas_port->phy_mask, values larger then size of
this field shouldn't be allowed.

Signed-off-by: Tomas Henzl <thenzl@redhat.com>
Link: https://lore.kernel.org/r/20240226151013.8653-1-thenzl@redhat.com
Acked-by: Sathya Prakash Veerichetty <sathya.prakash@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

diff --git a/drivers/scsi/mpi3mr/mpi3mr_transport.c b/drivers/scsi/mpi3mr/mpi3mr_transport.c
index d32ad46318cb09af970085b3ab00fc376a934e4f..7ca9a7c2709cfed3b2741de872ab2900a7bb64ee 100644 (file)
--- a/drivers/scsi/mpi3mr/mpi3mr_transport.c
+++ b/drivers/scsi/mpi3mr/mpi3mr_transport.c
@@ -1355,11 +1355,21 @@ static struct mpi3mr_sas_port *mpi3mr_sas_port_add(struct mpi3mr_ioc *mrioc,
        mpi3mr_sas_port_sanity_check(mrioc, mr_sas_node,
            mr_sas_port->remote_identify.sas_address, hba_port);
 
+       if (mr_sas_node->num_phys > sizeof(mr_sas_port->phy_mask) * 8)
+               ioc_info(mrioc, "max port count %u could be too high\n",
+                   mr_sas_node->num_phys);
+
        for (i = 0; i < mr_sas_node->num_phys; i++) {
                if ((mr_sas_node->phy[i].remote_identify.sas_address !=
                    mr_sas_port->remote_identify.sas_address) ||
                    (mr_sas_node->phy[i].hba_port != hba_port))
                        continue;
+
+               if (i > sizeof(mr_sas_port->phy_mask) * 8) {
+                       ioc_warn(mrioc, "skipping port %u, max allowed value is %lu\n",
+                           i, sizeof(mr_sas_port->phy_mask) * 8);
+                       goto out_fail;
+               }
                list_add_tail(&mr_sas_node->phy[i].port_siblings,
                    &mr_sas_port->phy_list);
                mr_sas_port->num_phys++;