From nobody Sun Feb 8 11:45:14 2026 Received: from mail-pl1-f172.google.com (mail-pl1-f172.google.com [209.85.214.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3D63A3EF0D4 for ; Wed, 21 Jan 2026 11:45:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.172 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768995954; cv=none; b=cbWYGKmcB1G6D8fF82Pw3GFZ7h9RYC2vOPl3/M0fyx6dO0WA2l0UQSoLyYV3UA4WHQO2Lns3LImMW+ik8akE0IhkRoFa2f0eEJ0DZknbBvwosBkEoXAHDHSQcS4bThcOSWj5/q0w0EduTaXQPX/K+ukoXMiVMQpo9yWQfa/RJ6g= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768995954; c=relaxed/simple; bh=q0nXYUTVHL7oTpqvqvnHVC0mTJIX7qTvjAnt9fZmCbM=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=f9cObviLb/pLm9/Nm8IVBbuUlG7qI4PvE0xlAPIPUaNlsDXlXYpgrlL83+Ksc1bNvsD34oSYvNnQ0lYIP4cNp0UmPekfg9nvUKwDMs5CY6L5yG6TiSSSAq+p73TmIgiZpieUcvHRY/LFZZtchrmds17QWzAUvHtoAkU5036WkEg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=b3g7+MjT; arc=none smtp.client-ip=209.85.214.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="b3g7+MjT" Received: by mail-pl1-f172.google.com with SMTP id d9443c01a7336-2a07fac8aa1so48661375ad.1 for ; Wed, 21 Jan 2026 03:45:51 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1768995951; x=1769600751; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=BWo+ADtM0PepfwlVMNfkHCoJb3HNoaWfK0fd0LWDbx0=; b=b3g7+MjTT0r7X7FV1SjzBQjJzeUnFEtCzPcGem1QNh9qU9pVRM9fXtyzA1oj2/A5Xa q8NMzHsFQHjLs2jJjhOaD9eM6MJbO+zg+87r8e76L9hJpjrRKJuWn5IHKCEnE93kPHjH wGI3ZIXy5+M15s5WLVKRDdWv6wjbNBa4PYivJ0kC0mrwXkN+sldYPoukhgj/wBnFW5Kg cNqRo2XdIyzezoVCVm8kcSpLSX/DO01kiv+B3N4xGML8Tu/nR1DgARpAZ+OaElnOpt+x 8JuaDntkdMwizzlnww5TdklCqPiJR9MRzQwOMZtSG7P3Ry8NzZplJUp6ktZ67gomFrW8 3ZtQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1768995951; x=1769600751; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=BWo+ADtM0PepfwlVMNfkHCoJb3HNoaWfK0fd0LWDbx0=; b=cOw3XQLRnsFx2A9ftPgU2qdhHiplWxsCzJE53cneUA/krO6AnZ7BKLNVNT0Hs9x8sM FxM1C2GJpbse+hgrT82Io8hWGClKsi6rT83pco6PUHoY49ZGxyDcLGjVcIBO2bzfnA9x fA/HvEiVHkRaMS9X7I1b/VUdZUAKBkz3O2n+7T3D+7eHigtL32NWDqTrBygCzRjTKySE EV36jbZyAp/qb6nw+zqnyRLKrsardbIgRA3RdNI5p//rZhRc67AK2LFCTWhPCL2tV7MZ tWln67Czn0olSe7MVA041p3r4t1/Nas4AlTtWU1zLkkyBuuTTBRXA1RX3h/Qgo6/26m7 GiGw== X-Forwarded-Encrypted: i=1; AJvYcCUuSngzqO2POQtB5zswXxX3QnTTcTQSxhh4SuI8lHXDwPPssfeY9KLA+d0hthXb5EFrqzzrVTDAoz7kccw=@vger.kernel.org X-Gm-Message-State: AOJu0YxvRVFmECelmP93Q5w1wAu3Cp/na4Ywy9M4qvtvGuR2JhboCpZJ UwzdFkPOQBTVXgqQqZhFqPrQbQMqS66r5XU4egjwZVSzqHEwrkfqlAg= X-Gm-Gg: AZuq6aL2CCVIHb1ZigG+gQKnYQOtVSG3Rk04VaKuy4icWlx6wzJAM1CdCg6ztNtT98y cNXjbCWIR1SSuqX2LYI2aI0XiX7KjHB8c+Q4f2WmMrbiZ6PxU4oC2FqvzU7c/Sr+K/ly8grnClz Gen2ptxzwitLOUfxj6fjI7Xfbu+3i7kI8CxFemTfCdQyyBIa/luJ+1OGjRzvJ2i0xNAjxPozBB1 qKYVZ25qzRofiZaALoDVX8H0JDr8kJUYpLtbmdhUdeTcIMCP68fMfNNLmx+6u8sqiKXWnGMrjZH Z8bUMPt3kebdjeLmUQpjQXBiurO5UyzKL0MTiZNb7zCkYQgKpTjuhu6/oZVan1Uo62G8YfCSaTl 131V2WIavOGAI03+9uhTMWyLffJZGqOw2pRByptRnqGS/JDjnojpPOg1wdtzbLXA4gCeq3iTJ/H XZlMt+WjTMt69UdrI= X-Received: by 2002:a17:902:f689:b0:2a0:a92c:2cb6 with SMTP id d9443c01a7336-2a76ad6bb37mr48689235ad.36.1768995951314; Wed, 21 Jan 2026 03:45:51 -0800 (PST) Received: from DESKTOP-BKIPFGN ([38.76.140.13]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2a76c5f4fb0sm47054085ad.45.2026.01.21.03.45.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 21 Jan 2026 03:45:50 -0800 (PST) From: Kery Qi To: bootc@bootc.net, martin.petersen@oracle.com Cc: nab@linux-iscsi.org, stefanr@s5r6.in-berlin.de, linux-scsi@vger.kernel.org, target-devel@vger.kernel.org, linux1394-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org, Kery Qi Subject: [PATCH] firewire: sbp-target: fix integer type overflow in sbp_make_tpg() Date: Wed, 21 Jan 2026 19:45:15 +0800 Message-ID: <20260121114515.1829-2-qikeyu2017@gmail.com> X-Mailer: git-send-email 2.50.1.windows.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The code in sbp_make_tpg() limits "tpgt" to UINT_MAX but the data type of "tpg->tport_tpgt" is u16. This causes a type truncation issue. When a user creates a TPG via configfs mkdir, for example: mkdir /sys/kernel/config/target/sbp//tpgt_70000 The value 70000 passes the "tpgt > UINT_MAX" check since 70000 is far less than 4294967295. However, when assigned to the u16 field tpg->tport_tpgt, the value is silently truncated to 4464 (70000 & 0xFFFF). This causes the value the user specified to differ from what is actually stored, leading to confusion and potential unexpected behavior. Fix this by changing the type of "tpgt" to u16 and using kstrtou16() which will properly reject values outside the u16 range. Fixes: a511ce3397803 ("sbp-target: Initial merge of firewire/ieee-1394 targ= et mode support") Signed-off-by: Kery Qi --- drivers/target/sbp/sbp_target.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/target/sbp/sbp_target.c b/drivers/target/sbp/sbp_targe= t.c index 9f167ff8da7b..09120a538a40 100644 --- a/drivers/target/sbp/sbp_target.c +++ b/drivers/target/sbp/sbp_target.c @@ -1960,12 +1960,12 @@ static struct se_portal_group *sbp_make_tpg(struct = se_wwn *wwn, container_of(wwn, struct sbp_tport, tport_wwn); =20 struct sbp_tpg *tpg; - unsigned long tpgt; + u16 tpgt; int ret; =20 if (strstr(name, "tpgt_") !=3D name) return ERR_PTR(-EINVAL); - if (kstrtoul(name + 5, 10, &tpgt) || tpgt > UINT_MAX) + if (kstrtou16(name + 5, 10, &tpgt)) return ERR_PTR(-EINVAL); =20 if (tport->tpg) { --=20 2.34.1