From nobody Tue Sep 29 13:20:15 2026 Received: from mail-wm2-f11.google.com (mail-wm2-f11.google.com [74.125.225.139]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6061B37DAB1 for ; Fri, 7 Aug 2026 08:03:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.225.139 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786089840; cv=none; b=EkziEnwAuzJUmGmVmRBCI65/Z4AcpKzvy/cpw/ATFlQd/uoR9hj9CYOoc8EwsxzZjeJoCCBP9HMMK60LW15XvBvgP66ccuNQi8Vytnp2vlBFf5dUSdpj5yF2dDfC1AISC5hE7msTy22Z3e7bmiWFWEEUqNp1plYTiYQCtSt+sG0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786089840; c=relaxed/simple; bh=wpA4wGKdfEQsAb+ErKq9hRB41Ak0nTG/7HtyFUq9sbs=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Od8MsaNow9vbeSvLl/DpfHIE10ha6nqj5Nr+YYY5qEVwAk4hC+5GjPGZSieUVfwzuT0XbfCNhvpv86dNFyMLUTHLkhsB/Xeeg+SMQqSvtSfwJD4HCj5FZxcLnqqMiTbbpDUGJeUXPD7/uH1OrYDZ2vyRoeyLn0U/PHT1rpKi34Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=WWJuHt3G; arc=none smtp.client-ip=74.125.225.139 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="WWJuHt3G" Received: by mail-wm2-f11.google.com with SMTP id 5b1f17b1804b1-4994d67d2e7so6834705e9.0 for ; Fri, 07 Aug 2026 01:03:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786089837; x=1786694637; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=2Os9gmZ7ykjaOOgcnZPDqpq/qN85Sh8iZbFNg2fS1NY=; b=WWJuHt3GPF5QCjBrirxD0tZ0heE7PAobjsEfhCIXIZjS4VoyNoq9gEt4v9R688GbPI QnrEZjk3wnvQT9ubtmgug9H571oBVr6mkXQz54rUXt0KWF9Hv2vOfdrAMOHLN/2yYGpx MIUMydBSPASA5BiCeDRCOl+t6MKIYeCj5c/6/QJIzGrK4tejFtuwW2yg51C4PiIS7shU KnqxATigi4ZGuPNvZYROlmY22JGkHfvf/rQZ07P8KQbvrAIfW6zjeCiIX4Uiaq85TFbk FqS2qYSLRzXbHVg1YZV8LduHyF6j0M/PpBcocNeexAjPT/++7JwPMtsWwbhhE9uid+lR GLBw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786089837; x=1786694637; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=2Os9gmZ7ykjaOOgcnZPDqpq/qN85Sh8iZbFNg2fS1NY=; b=qyG4Km6kBgaDiFr9/ViOn8zmQSmKjmMk3J5VGLdHlX0ajMS0hlAMBBIgqcqSJucxCn wzScGACgy4Leh0Cal6GTLbGJZRHbOHWMMbbv3xjuzpzMdUtSO7Pcqgo0kU/DN9nIu70x Xm6CPPXxu5tSVOB0/3v/gK2TtQWNvDhPNFUL5duyCY9hyz+oj/QHy82VjAzPfixJs0ou EVRVWPIGiVoKwILFcVy59OpAhIPGtkJWOzFQcSeusnJICq+UEKUfx79AUZYBBU7mxKyl 9OWY3cdbW3sP3nD+9Bk4TfSi9OvqOP0nO3MaYAXsa/B89Ndmuil/U2KsCwrrx9r37Cgy 0QGQ== X-Forwarded-Encrypted: i=1; AHgh+Ro6tPsG2y+U3MbUBrHj3JSsAsRPz3hqOKkoYWDV8xgguFSNH7CmYvB2sLbdSR0Ed6s8NW2xESvEx4AxQpo=@vger.kernel.org X-Gm-Message-State: AOJu0Yxr6d32qekqfiBNZ7K0ofQ6ua5T00vmaLFYbtO+DHZQEXK1k3Ch CeiYm30opnQ3fqWMnr/PXOUf84pYPkUumdbxg8s/t4bHyzCLx+KQHJlC X-Gm-Gg: AR+sD11FSEJiQoMMn1PT2Tj2SpCvGVTKfgupHXv4YFgt3AfLlrp7UgCIttfpHcPmCVq VF2OHzeEtRGoQQm474ok3DZDoTp8ZbyzISMNXxIKJtfSy6Q+fCKzaPtJI4bFOqQDVX1GarrIF13 2K7PcyAF7to2HqptE5nEZZ4VLGWD7w26T/lHx08WWRmECfPvHY5WAGbK+Y3B4iIF0jpdaaBg7Ss 8O3d1HleRuEj+rQQ8qurUvmB1bNjArcbBroEJ56kxaUvwktjD4rDKGukmaaSJxGdDV5lhg8xc1T c4bJzlmTk+udpvLfo8Ni3ODk6yxLIATLRmkrHTFvJ9LRyVDn33ix1Oi3AG8WsIgQA2gFoijG3FH xLGbPncmea0zEReDNb231F9KPKeLQ/sAyMycmQfDH/sgM2WKEgFONnCXRAfINjFo9l4ANgJjze4 lnO6yf6ZfxtlS6Ja/YWCQlKVLCBDsl4aVLEDKAAZQpN17pHtLVR+nvX3R80gU72d/yu+7j5hxop 1K7Wg== X-Received: by 2002:a05:600c:3422:b0:496:c18c:f9a1 with SMTP id 5b1f17b1804b1-4994e7cb6abmr216202005e9.14.1786089835700; Fri, 07 Aug 2026 01:03:55 -0700 (PDT) Received: from localhost.localdomain ([78.40.184.2]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4995d85b96csm13881625e9.2.2026.08.07.01.03.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 07 Aug 2026 01:03:55 -0700 (PDT) From: Roman Demidov To: Matthew Wilcox Cc: Roman Demidov , Hannes Reinecke , "James E.J. Bottomley" , "Martin K. Petersen" , linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org, lvc-project@linuxtesting.org Subject: [PATCH] scsi: advansys: Fix invalid comparison in AdvBuildCarrierFreelist Date: Fri, 7 Aug 2026 11:03:37 +0300 Message-ID: <20260807080339.9365-1-roman.demidov.nn@gmail.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The loop index i takes values from 0 to carr_num - 1 therefore the comparison i =3D=3D carr_num is always false. The assignment next_offset =3D ~0 must occur for the last element of the list, its index is carr_num - 1. In the adv_get_next_carrier() function, the last element of the list is determined by the value next_vpa =3D ~0 or next_vpa =3D 0. If adv_get_next_carrier() is called with the last element of the list as an argument, instead of returning NULL, adv_get_carrier() will be called with an invalid offset. The resulting address is outside the bounds of the allocated memory, after which carrp->next_vpa is written, leading to memory corruption. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 98b96a7d99c8 ("advansys: Use DMA-API for carrier buffer") Signed-off-by: Roman Demidov --- drivers/scsi/advansys.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/advansys.c b/drivers/scsi/advansys.c index 5cdbf2bdb13d..95a227420b28 100644 --- a/drivers/scsi/advansys.c +++ b/drivers/scsi/advansys.c @@ -4169,7 +4169,7 @@ static void AdvBuildCarrierFreelist(struct adv_dvc_va= r *adv_dvc) adv_dvc->carrier[i].carr_va =3D cpu_to_le32(carr_offset); adv_dvc->carrier[i].areq_vpa =3D 0; next_offset =3D carr_offset + sizeof(ADV_CARR_T); - if (i =3D=3D carr_num) + if (i =3D=3D carr_num - 1) next_offset =3D ~0; adv_dvc->carrier[i].next_vpa =3D cpu_to_le32(next_offset); } --=20 2.53.0