mvumi_show_event() prints param_count u32 words from params[] and sense_data_length bytes from sense_data[], but both counts come from the firmware event (struct mvumi_driver_event) and are never checked against the arrays, which hold four words and 30 bytes. A firmware that reports the maximum (255 each) makes the loops read far past the event and past the 512-byte buffer the event block is allocated in, printing the result to the kernel log. Stop each loop at the size of its array. Fixes: f0c568a478f0 ("[SCSI] mvumi: Add Marvell UMI driver") Cc: stable@vger.kernel.org Signed-off-by: Yehyeong Lee --- drivers/scsi/mvumi.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/mvumi.c b/drivers/scsi/mvumi.c index e70d336b4ab39..38a92f8c25f5b 100644 --- a/drivers/scsi/mvumi.c +++ b/drivers/scsi/mvumi.c @@ -1361,7 +1361,8 @@ static void mvumi_show_event(struct mvumi_hba *mhba, if (ptr->param_count) { printk(KERN_WARNING "Event param(len 0x%x): ", ptr->param_count); - for (i = 0; i < ptr->param_count; i++) + for (i = 0; i < ptr->param_count && + i < ARRAY_SIZE(ptr->params); i++) printk(KERN_WARNING "0x%x ", ptr->params[i]); printk(KERN_WARNING "\n"); @@ -1370,7 +1371,8 @@ static void mvumi_show_event(struct mvumi_hba *mhba, if (ptr->sense_data_length) { printk(KERN_WARNING "Event sense data(len 0x%x): ", ptr->sense_data_length); - for (i = 0; i < ptr->sense_data_length; i++) + for (i = 0; i < ptr->sense_data_length && + i < sizeof(ptr->sense_data); i++) printk(KERN_WARNING "0x%x ", ptr->sense_data[i]); printk(KERN_WARNING "\n"); } -- 2.43.0