[PATCH 08/21] scsi: mpi3mr: Fix integer overflow in the log data size calculation

[Ranjan Kumar <ranjan.kumar@broadcom.com>]

The number of log entries and their total size are held in 16 bits. With a
large entry size the product wraps around, so the driver copies only part
of the log data and still reports success.

Use 32 bit variables for both values.

Fixes: f5e6d5a34376 ("scsi: mpi3mr: Add support for driver commands")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260825210411.301535-1-chandrakanth.patil@broadcom.com?part=5
Closes: https://sashiko.dev/#/patchset/20260825210411.301535-1-chandrakanth.patil@broadcom.com?part=13
Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
---
 drivers/scsi/mpi3mr/mpi3mr_app.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/mpi3mr/mpi3mr_app.c b/drivers/scsi/mpi3mr/mpi3mr_app.c
index a68552c9dafa..bd105efdd9cb 100644
--- a/drivers/scsi/mpi3mr/mpi3mr_app.c
+++ b/drivers/scsi/mpi3mr/mpi3mr_app.c
@@ -1346,7 +1346,8 @@ static long mpi3mr_enable_logdata(struct mpi3mr_ioc *mrioc,
 static long mpi3mr_get_logdata(struct mpi3mr_ioc *mrioc,
 	struct bsg_job *job)
 {
-	u16 num_entries, sz, entry_sz = mrioc->logdata_entry_sz;
+	u16 entry_sz = mrioc->logdata_entry_sz;
+	u32 num_entries, sz;
 
 	if ((!mrioc->logdata_buf) || (job->request_payload.payload_len < entry_sz))
 		return -EINVAL;
-- 
2.47.3