[PATCH 2/2] scsi: aacraid: bound the HBA sense response copy to the source buffer

[Yehyeong Lee]

hba_resp_task_complete() copies the sense data from a native HBA
response into the command's sense buffer, using a length that is only
capped at SCSI_SENSE_BUFFERSIZE (96 bytes).  The source,
err->sense_response_buf, is HBA_SENSE_DATA_LEN_MAX (32 bytes), so an
adapter that reports a larger sense_response_data_len makes the copy
read up to 64 bytes past the array and hand that memory to user space
in the sense buffer.

Cap the copy at the size of the source array.

Fixes: ab5d129f93c9 ("scsi: aacraid: Add task management functionality")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Yehyeong Lee <yhlee@xxxxxxxxxxxxxxxxxx>
---
 drivers/scsi/aacraid/aachba.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/aacraid/aachba.c b/drivers/scsi/aacraid/aachba.c
index 89d8e33517584..23512648e389e 100644
--- a/drivers/scsi/aacraid/aachba.c
+++ b/drivers/scsi/aacraid/aachba.c
@@ -3579,7 +3579,7 @@ static void hba_resp_task_complete(struct aac_dev *dev,
 		int len;
 
 		len = min_t(u8, err->sense_response_data_len,
-			SCSI_SENSE_BUFFERSIZE);
+			sizeof(err->sense_response_buf));
 		if (len)
 			memcpy(scsicmd->sense_buffer,
 				err->sense_response_buf, len);
-- 
2.43.0