[PATCH] scsi: mpt3sas: clamp ValidEntries in driver trigger pg2 store

[Weibin Liu]

The driver trigger page 2 store path copies the user-supplied
event_tg->ValidEntries directly into tg_pg2.NumMPIEventTrigger and
then iterates over it while filling MPIEventTriggers[]. The array
holds NUM_VALID_ENTRIES (20) entries, so a ValidEntries value larger
than that causes an out-of-bounds read of event_tg->EventTriggerEntry[]
and an out-of-bounds write into the on-stack tg_pg2 structure.

The local copy of the trigger data is only clamped later inside
diag_trigger_event(), which is too late for this path.

Clamp count to NUM_VALID_ENTRIES before using it as the loop bound
and when programming NumMPIEventTrigger.

Reviewed-by: Liu Chao <liuc63@xxxxxxxxxxxx>
Fixes: 71b3fb8fe6dd ("scsi: mpt3sas: Add persistent Event trigger page")
Cc: stable@xxxxxxxxxxxxxxx # 5.11+
Signed-off-by: Weibin Liu <liuwb@xxxxxxxxxxxx>
---
 drivers/scsi/mpt3sas/mpt3sas_config.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/scsi/mpt3sas/mpt3sas_config.c b/drivers/scsi/mpt3sas/mpt3sas_config.c
index b0d5ef893600..62999682ce95 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_config.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_config.c
@@ -2278,6 +2278,8 @@ mpt3sas_config_update_driver_trigger_pg2(struct MPT3SAS_ADAPTER *ioc,
 
 	if (set) {
 		count = event_tg->ValidEntries;
+		if (count > NUM_VALID_ENTRIES)
+			count = NUM_VALID_ENTRIES;
 		tg_pg2.NumMPIEventTrigger = cpu_to_le16(count);
 		for (i = 0; i < count; i++) {
 			tg_pg2.MPIEventTriggers[i].MPIEventCode =

---
base-commit: 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907
change-id: 20261015-mpt3sas-validentries-b7c58d8b3966

Best regards,
-- 
Weibin Liu <liuwb@xxxxxxxxxxxx>