[PATCH] scsi: myrb: Fix DMA buffer overflow in error table handling

Hongling Zeng posted 1 patch 4 days, 21 hours ago
drivers/scsi/myrb.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
[PATCH] scsi: myrb: Fix DMA buffer overflow in error table handling
Posted by Hongling Zeng 4 days, 21 hours ago
Fix DMA buffer overflow where firmware can write up to 80 error entries
into a 48-entry buffer (3 channels x 16 targets), causing kernel
memory corruption. Also fix out-of-bounds stack access in
myrb_get_errtable().

Increase MYRB_MAX_CHANNELS from 3 to 8 to support all controller
configurations up to 5 channels.

Cc: stable@vger.kernel.org
Fixes: 081ff398c56c ("scsi: myrb: Add Mylex RAID controller (block interface)")
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
---
 drivers/scsi/myrb.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/myrb.h b/drivers/scsi/myrb.h
index 78dc4136fb10..c2c958481ab7 100644
--- a/drivers/scsi/myrb.h
+++ b/drivers/scsi/myrb.h
@@ -14,7 +14,7 @@
 #define MYRB_H
 
 #define MYRB_MAX_LDEVS			32
-#define MYRB_MAX_CHANNELS		3
+#define MYRB_MAX_CHANNELS		8
 #define MYRB_MAX_TARGETS		16
 #define MYRB_MAX_PHYSICAL_DEVICES	45
 #define MYRB_SCATTER_GATHER_LIMIT	32
--
2.25.1