[PATCH 17/21] scsi: mpi3mr: Reject a too small reply size when enabling log data

[Ranjan Kumar <ranjan.kumar@broadcom.com>]

The log data entry size is computed from the reply frame size that the
firmware reports. If that size is 20 the entry size becomes 0, the buffer
pointer is a zero size pointer, and the next log event or read uses it.
Smaller sizes wrap to a huge entry size.

Refuse to enable log data when the reply frame cannot hold the event
header.

Fixes: f5e6d5a34376 ("scsi: mpi3mr: Add support for driver commands")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260825210411.301535-1-chandrakanth.patil@broadcom.com?part=5
Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
---
 drivers/scsi/mpi3mr/mpi3mr_app.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/scsi/mpi3mr/mpi3mr_app.c b/drivers/scsi/mpi3mr/mpi3mr_app.c
index fb54bd8093da..bf2c8c413a80 100644
--- a/drivers/scsi/mpi3mr/mpi3mr_app.c
+++ b/drivers/scsi/mpi3mr/mpi3mr_app.c
@@ -1311,6 +1311,9 @@ static long mpi3mr_enable_logdata(struct mpi3mr_ioc *mrioc,
 	struct mpi3mr_logdata_enable logdata_enable;
 
 	if (!mrioc->logdata_buf) {
+		if (mrioc->reply_sz <=
+		    (sizeof(struct mpi3_event_notification_reply) - 4))
+			return -EINVAL;
 		mrioc->logdata_entry_sz =
 		    (mrioc->reply_sz - (sizeof(struct mpi3_event_notification_reply) - 4))
 		    + MPI3MR_BSG_LOGDATA_ENTRY_HEADER_SZ;
-- 
2.47.3