[PATCH] scsi: sg: update local scatter size when clamping

[Jiacheng Xu]

When scatter_elem_sz is set to a value smaller than PAGE_SIZE through
its writable sysfs module parameter, sg_build_indirect() updates the
global scatter element size variables but leaves the local num
variable unchanged.

If the parameter is set to zero, get_order(num) is called with zero,
for which its result is undefined. On 64-bit systems, the current
implementation returns an order of 64 - PAGE_SHIFT. This causes:

    ret_sz = 1 << (PAGE_SHIFT + order);

to shift a 32-bit integer by 64 bits, triggering:

    UBSAN: shift-out-of-bounds in sg_build_indirect

Update num together with the global values when clamping it to
PAGE_SIZE.

Fixes: 6460e75a104d ("[SCSI] sg: fixes for large page_size")
Signed-off-by: Jiacheng Xu <stitch@xxxxxxxxxx>
---
 drivers/scsi/sg.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 5408f002e6c0..69013335e433 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -1876,6 +1876,7 @@ sg_build_indirect(Sg_scatter_hold * schp, Sg_fd * sfp, int buff_size)
 	num = scatter_elem_sz;
 	if (unlikely(num != scatter_elem_sz_prev)) {
 		if (num < PAGE_SIZE) {
+			num = PAGE_SIZE;
 			scatter_elem_sz = PAGE_SIZE;
 			scatter_elem_sz_prev = PAGE_SIZE;
 		} else
-- 
2.25.1