diff options
| author | Xingui Yang <yangxingui@huawei.com> | 2026-10-09 11:32:35 +0800 |
|---|---|---|
| committer | Martin K. Petersen (Oracle) <mkp@kernel.org> | 2026-10-14 22:21:18 -0400 |
| commit | 4d7f9c3fdce773f6c69d17c1d4a05bd5e17f4b99 (patch) | |
| tree | 0d07fe1d0c540ac0bfc1e9729c405bc42abf90c3 /tools/lib/python | |
| parent | b633249f58832e6aeefa606d6d5aec76abfe6d89 (diff) | |
scsi: libsas: Fix out-of-bounds memcpy() in sas_ssp_task_response()
The min_t(int, ...) clamp of the device-provided sense_data_len turns
negative for values >= 0x80000000 and is then used as the memcpy()
length, reading and writing out of bounds. Compare as u32
instead. Well-formed responses are unaffected.
Fixes: 366ca51f30de ("[SCSI] libsas: abstract STP task status into a function")
Signed-off-by: Xingui Yang <yangxingui@huawei.com>
Link: https://patch.msgid.link/20261009033238.1076098-2-yangxingui@huawei.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Diffstat (limited to 'tools/lib/python')
0 files changed, 0 insertions, 0 deletions