[PATCH] scsi: mpt3sas: validate data_out size before SMP link-reset check

[PATCH] scsi: mpt3sas: validate data_out size before SMP link-reset check

[Weibin Liu]

_ctl_do_mpt_command() handles MPI2_FUNCTION_SMP_PASSTHROUGH by reading
data[1] and data[10] of the data_out buffer to detect SMP link-reset
requests. The non-IMMEDIATE path sets data = data_out without checking
data_out_sz, so a request whose data_out payload is smaller than 11
bytes reads past the end of the DMA coherent buffer, and out-of-bounds
bytes can silently set ioc_link_reset_in_progress and ignore_loginfos.

Require data_out_sz >= 11 bytes alongside !data_out before touching
the payload. The IMMEDIATE path reads within the request frame itself
and needs no guard.

Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS")
Cc: stable@vger.kernel.org # 3.8+
Signed-off-by: Weibin Liu <liuwb@xiaopeng.com>
Reviewed-by: Guanglei Zhu <zhugl3@xiaopeng.com>
---
 drivers/scsi/mpt3sas/mpt3sas_ctl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/mpt3sas/mpt3sas_ctl.c b/drivers/scsi/mpt3sas/mpt3sas_ctl.c
index 8bb947004885..ae9b2be51ce0 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_ctl.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_ctl.c
@@ -968,7 +968,7 @@ _ctl_do_mpt_command(struct MPT3SAS_ADAPTER *ioc, struct mpt3_ioctl_command karg,
 		    MPI2_SMP_PT_REQ_PT_FLAGS_IMMEDIATE)
 			data = (u8 *)&smp_request->SGL;
 		else {
-			if (unlikely(data_out == NULL)) {
+			if (unlikely(!data_out || data_out_sz < 11)) {
 				pr_err("failure at %s:%d/%s()!\n",
 				    __FILE__, __LINE__, __func__);
 				mpt3sas_base_free_smid(ioc, smid);

---
base-commit: 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907
change-id: 20261015-mpt3sas-dataout-sz-a8a0b367cd4f

Best regards,
-- 
Weibin Liu <liuwb@xiaopeng.com>

Re: [PATCH] scsi: mpt3sas: validate data_out size before SMP link-reset check

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] scsi: mpt3sas: UAPI regression breaking short SMP requests
--

commit c6e5c105f2c358ce97748e66aceca72796ee77b8
Author: Weibin Liu <liuwb@xiaopeng.com>

scsi: mpt3sas: validate data_out size before SMP link-reset check

This commit prevents an out-of-bounds read in _ctl_do_mpt_command() by
validating the size of the data_out buffer before checking for SMP link
reset requests on non-IMMEDIATE SMP PASSTHROUGH commands.

> diff --git a/drivers/scsi/mpt3sas/mpt3sas_ctl.c b/drivers/scsi/mpt3sas/mpt3sas_ctl.c
> index 8bb947004885b..ae9b2be51ce0f 100644
> --- a/drivers/scsi/mpt3sas/mpt3sas_ctl.c
> +++ b/drivers/scsi/mpt3sas/mpt3sas_ctl.c
> @@ -968,7 +968,7 @@ _ctl_do_mpt_command(struct MPT3SAS_ADAPTER *ioc, struct mpt3_ioctl_command karg,
>  		    MPI2_SMP_PT_REQ_PT_FLAGS_IMMEDIATE)
>  			data = (u8 *)&smp_request->SGL;
>  		else {
> -			if (unlikely(data_out == NULL)) {
> +			if (unlikely(!data_out || data_out_sz < 11)) {

[Severity: High]
Does this cause a regression for valid short SMP requests?

By enforcing data_out_sz >= 11 and returning -EINVAL on shorter payloads,
this change appears to prevent user-space applications (such as smp_utils
or lsiutil) from sending standard short SMP commands (like
SMP_REPORT_GENERAL, which has an 8-byte payload) via the MPT3COMMAND ioctl
using a non-immediate payload buffer.

Before this patch, short commands were successfully sent to the hardware,
even though the driver incorrectly read data[10] out of bounds.

Could this be resolved by instead checking the payload size only when
evaluating the link reset detection logic later in the function?

For example:
	if (data_out_sz >= 11 && data[1] == 0x91 && (data[10] == 1 || ...))

>  				pr_err("failure at %s:%d/%s()!\n",
>  				    __FILE__, __LINE__, __func__);
>  				mpt3sas_base_free_smid(ioc, smid);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015-mpt3sas-dataout-sz-v1-1-0781d24bb7ad@xiaopeng.com?part=1