[PATCH] scsi: mpt3sas: validate data_out size before SMP link-reset check
From: Weibin Liu
Date: Wed Oct 14 2026 - 22:07:53 EST
_ctl_do_mpt_command() handles MPI2_FUNCTION_SMP_PASSTHROUGH by reading
data[1] and data[10] of the data_out buffer to detect SMP link-reset
requests. The non-IMMEDIATE path sets data = data_out without checking
data_out_sz, so a request whose data_out payload is smaller than 11
bytes reads past the end of the DMA coherent buffer, and out-of-bounds
bytes can silently set ioc_link_reset_in_progress and ignore_loginfos.
Require data_out_sz >= 11 bytes alongside !data_out before touching
the payload. The IMMEDIATE path reads within the request frame itself
and needs no guard.
Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS")
Cc: stable@xxxxxxxxxxxxxxx # 3.8+
Signed-off-by: Weibin Liu <liuwb@xxxxxxxxxxxx>
Reviewed-by: Guanglei Zhu <zhugl3@xxxxxxxxxxxx>
---
drivers/scsi/mpt3sas/mpt3sas_ctl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/mpt3sas/mpt3sas_ctl.c b/drivers/scsi/mpt3sas/mpt3sas_ctl.c
index 8bb947004885..ae9b2be51ce0 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_ctl.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_ctl.c
@@ -968,7 +968,7 @@ _ctl_do_mpt_command(struct MPT3SAS_ADAPTER *ioc, struct mpt3_ioctl_command karg,
MPI2_SMP_PT_REQ_PT_FLAGS_IMMEDIATE)
data = (u8 *)&smp_request->SGL;
else {
- if (unlikely(data_out == NULL)) {
+ if (unlikely(!data_out || data_out_sz < 11)) {
pr_err("failure at %s:%d/%s()!\n",
__FILE__, __LINE__, __func__);
mpt3sas_base_free_smid(ioc, smid);
---
base-commit: 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907
change-id: 20261015-mpt3sas-dataout-sz-a8a0b367cd4f
Best regards,
--
Weibin Liu <liuwb@xxxxxxxxxxxx>