Re: [PATCH] scsi: mpt3sas: validate data_out size before SMP link-reset check

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] scsi: mpt3sas: UAPI regression breaking short SMP requests
--

commit c6e5c105f2c358ce97748e66aceca72796ee77b8
Author: Weibin Liu <liuwb@xiaopeng.com>

scsi: mpt3sas: validate data_out size before SMP link-reset check

This commit prevents an out-of-bounds read in _ctl_do_mpt_command() by
validating the size of the data_out buffer before checking for SMP link
reset requests on non-IMMEDIATE SMP PASSTHROUGH commands.

> diff --git a/drivers/scsi/mpt3sas/mpt3sas_ctl.c b/drivers/scsi/mpt3sas/mpt3sas_ctl.c
> index 8bb947004885b..ae9b2be51ce0f 100644
> --- a/drivers/scsi/mpt3sas/mpt3sas_ctl.c
> +++ b/drivers/scsi/mpt3sas/mpt3sas_ctl.c
> @@ -968,7 +968,7 @@ _ctl_do_mpt_command(struct MPT3SAS_ADAPTER *ioc, struct mpt3_ioctl_command karg,
>  		    MPI2_SMP_PT_REQ_PT_FLAGS_IMMEDIATE)
>  			data = (u8 *)&smp_request->SGL;
>  		else {
> -			if (unlikely(data_out == NULL)) {
> +			if (unlikely(!data_out || data_out_sz < 11)) {

[Severity: High]
Does this cause a regression for valid short SMP requests?

By enforcing data_out_sz >= 11 and returning -EINVAL on shorter payloads,
this change appears to prevent user-space applications (such as smp_utils
or lsiutil) from sending standard short SMP commands (like
SMP_REPORT_GENERAL, which has an 8-byte payload) via the MPT3COMMAND ioctl
using a non-immediate payload buffer.

Before this patch, short commands were successfully sent to the hardware,
even though the driver incorrectly read data[10] out of bounds.

Could this be resolved by instead checking the payload size only when
evaluating the link reset detection logic later in the function?

For example:
	if (data_out_sz >= 11 && data[1] == 0x91 && (data[10] == 1 || ...))

>  				pr_err("failure at %s:%d/%s()!\n",
>  				    __FILE__, __LINE__, __func__);
>  				mpt3sas_base_free_smid(ioc, smid);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015-mpt3sas-dataout-sz-v1-1-0781d24bb7ad@xiaopeng.com?part=1