aac_srb_callback() copies the sense data from an adapter SRB reply into the command's sense buffer, using a length that is only capped at SCSI_SENSE_BUFFERSIZE (96 bytes). The source, srbreply->sense_data, is AAC_SENSE_BUFFERSIZE (30 bytes), so an adapter that reports a larger sense_data_size makes the copy read up to 66 bytes past the sense array. The reply is placed in the FIB data area that the outgoing SRB request was built in, and that area is not cleared between uses, so the bytes past the sense array are the previous request's scatter-gather list -- DMA addresses and lengths -- which are then handed to user space in the sense buffer of a pass-through command. Cap the copy at the size of the source array, matching the container sense paths in this driver. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Yehyeong Lee --- v2: - Drop the second patch from v1 (the HBA sense-response copy). As the review pointed out, struct aac_native_hba backs that response with a 512-byte union, so the copy was already within bounds and capping it to the 32-byte sense_response_buf would have truncated valid sense data; only this SRB bound remains. - The review also flagged that aac_srb_callback() overwrites, in the srb_status switch that follows, the DID_ERROR it sets on a FIB-level failure. That is pre-existing and independent of this length change, so it is left untouched here. v1: https://lore.kernel.org/linux-scsi/20261013140214.3156938-1-yhlee@isslab.korea.ac.kr/ drivers/scsi/aacraid/aachba.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/aacraid/aachba.c b/drivers/scsi/aacraid/aachba.c index df9492247631f..89d8e33517584 100644 --- a/drivers/scsi/aacraid/aachba.c +++ b/drivers/scsi/aacraid/aachba.c @@ -3418,7 +3418,7 @@ static void aac_srb_callback(void *context, struct fib * fibptr) pr_warn("aac_srb_callback: srb failed, status = %d\n", le32_to_cpu(srbreply->status)); len = min_t(u32, le32_to_cpu(srbreply->sense_data_size), - SCSI_SENSE_BUFFERSIZE); + sizeof(srbreply->sense_data)); scsicmd->result = DID_ERROR << 16 | SAM_STAT_CHECK_CONDITION; memcpy(scsicmd->sense_buffer, srbreply->sense_data, len); @@ -3544,7 +3544,7 @@ static void aac_srb_callback(void *context, struct fib * fibptr) scsicmd->result |= SAM_STAT_CHECK_CONDITION; len = min_t(u32, le32_to_cpu(srbreply->sense_data_size), - SCSI_SENSE_BUFFERSIZE); + sizeof(srbreply->sense_data)); #ifdef AAC_DETAILED_STATUS_INFO pr_warn("aac_srb_callback: check condition, status = %d len=%d\n", le32_to_cpu(srbreply->status), len); base-commit: 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907 -- 2.43.0