[PATCH 0/2] scsi: aacraid: bound adapter-declared sense lengths

[Yehyeong Lee]

Two spots in aacraid size a sense-data copy by the destination buffer
(SCSI_SENSE_BUFFERSIZE) rather than the source array, so an adapter that
over-reports its sense length makes the copy read past the source and
hand the trailing bytes -- the previous request's scatter-gather list
in the shared FIB area -- to user space.  Bound each copy at the source
array size, as the container sense paths already do.

The two sites have different origins (one is as old as the driver, the
other came with the native HBA path), so they are split for independent
backporting.

Yehyeong Lee (2):
  scsi: aacraid: bound the SRB sense data copy to the source buffer
  scsi: aacraid: bound the HBA sense response copy to the source buffer

 drivers/scsi/aacraid/aachba.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)


base-commit: 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907
-- 
2.43.0