[PATCH] scsi: hpsa: validate active path number before enclosure arrays

[Pengpeng Hou]

hpsa_get_enclosure_info() uses the firmware-provided
active_path_number as an index into the eight-entry box[] and
phys_connector[] arrays in struct hpsa_scsi_dev_t.  The value is not
checked before the array write and connector copy.

Reject enclosure information with an out-of-range active path number
before updating those fixed per-path arrays.

Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
---
 drivers/scsi/hpsa.c | 8 ++++++++
 1 file changed, 8 insertions(+)

--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -3501,6 +3501,14 @@
 
 	ei = c->err_info;
 	if (ei->CommandStatus != 0 && ei->CommandStatus != CMD_DATA_UNDERRUN) {
+		rc = -1;
+		goto out;
+	}
+
+	if (id_phys->active_path_number >= ARRAY_SIZE(encl_dev->box)) {
+		dev_warn(&h->pdev->dev,
+			 "%s: invalid active path %u for bdi[0x%x]\n",
+			 __func__, id_phys->active_path_number, bmic_device_index);
 		rc = -1;
 		goto out;
 	}