[PATCH] scsi: hpsa: clamp physical LUN count in fallback report

[Pengpeng Hou]

When REPORT PHYS EXTENDED is not supported,
hpsa_scsi_do_report_phys_luns() falls back to REPORT LUNS and converts
each 8-byte LUN entry into the extended report buffer. The number of
entries comes from the device-provided LUNListLength field, but the loop
did not clamp it to either the source ReportLUNdata array or the
destination ReportExtendedLUNdata array.

Clamp the converted count to both arrays and update the output
LUNListLength to match the entries that were actually copied.

Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
---
 drivers/scsi/hpsa.c |    4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index a1b116cd..a7115efd 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -3797,6 +3797,10 @@ static inline int hpsa_scsi_do_report_phys_luns(struct ctlr_info *h,
 		/* Copy ReportLUNdata header */
 		memcpy(buf, lbuf, 8);
 		nphys = be32_to_cpu(*((__be32 *)lbuf->LUNListLength)) / 8;
+		nphys = min_t(u32, nphys, ARRAY_SIZE(lbuf->LUN));
+		nphys = min_t(u32, nphys, ARRAY_SIZE(buf->LUN));
+		put_unaligned_be32(nphys * sizeof(buf->LUN[0]),
+				   buf->LUNListLength);
 		for (i = 0; i < nphys; i++)
 			memcpy(buf->LUN[i].lunid, lbuf->LUN[i], 8);
 	}