[PATCH] scsi: mpt3sas: fix OOB SGE write at the request frame boundary

[Weibin Liu]

_ctl_do_mpt_command() bounds the user-supplied data_sge_offset with
strict inequalities:

	if (karg.data_sge_offset * 4 > ioc->request_sz ||
	    karg.data_sge_offset > (UINT_MAX / 4)) {
		ret = -EINVAL;
		goto out;
	}

When data_sge_offset * 4 is exactly ioc->request_sz, both comparisons
pass. The SGE array pointer is then derived as

	psge = (void *)request + (karg.data_sge_offset * 4);

which points just past the end of the request frame. The per-function
SGE builders then write entries at psge; _base_build_sg(), for one,
emits a zero-length SGE there when data_out_sz and data_in_sz are both
zero. The write lands outside the request frame and corrupts adjacent
memory in the request DMA pool.

Use >= for the frame size comparison so that an offset placing the
start of the SGE array at or beyond the end of the request frame is
rejected with -EINVAL.

Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Weibin Liu <liuwb@xxxxxxxxxxxx>
---
 drivers/scsi/mpt3sas/mpt3sas_ctl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/mpt3sas/mpt3sas_ctl.c b/drivers/scsi/mpt3sas/mpt3sas_ctl.c
index 8bb947004885..d8d3ee11ed52 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_ctl.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_ctl.c
@@ -739,7 +739,7 @@ _ctl_do_mpt_command(struct MPT3SAS_ADAPTER *ioc, struct mpt3_ioctl_command karg,
 	}
 
 	/* Check for overflow and wraparound */
-	if (karg.data_sge_offset * 4 > ioc->request_sz ||
+	if (karg.data_sge_offset * 4 >= ioc->request_sz ||
 	    karg.data_sge_offset > (UINT_MAX / 4)) {
 		ret = -EINVAL;
 		goto out;

---
base-commit: 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907
change-id: 20261015-mpt3sas-sge-offset-38426dc931a6

Best regards,
-- 
Weibin Liu <liuwb@xxxxxxxxxxxx>