)]}'
{
  "commit": "e550f2b2b4aab4c5f12db89d04d8978ce4ed7b4e",
  "tree": "ebf7ec662fe131621ac0fbbe6baaba5165e891ac",
  "parents": [
    "08f08a6d49efc422258edba802faa4fc7677309e"
  ],
  "author": {
    "name": "Milan P. Gandhi",
    "email": "mgandhi@redhat.com",
    "time": "Thu Nov 05 17:54:01 2026 +0530"
  },
  "committer": {
    "name": "Martin K. Petersen (Oracle)",
    "email": "mkp@kernel.org",
    "time": "Sun Nov 08 22:36:12 2026 -0500"
  },
  "message": "scsi: mpi3mr: Validate reply frame size bounds\n\nFirmware provides reply_frame_size in dwords, which the driver multiplies\nby 4 to compute facts.reply_sz (u16). If the reported size exceeds U16_MAX\n/ 4, the multiplication overflows u16 before assignment, causing\nunder-allocated DMA reply buffers.\n\nFurthermore, several paths assume a minimal reply frame size:\n\n - logdata_entry_sz calculations underflow or hit zero when reply_sz \u003c\u003d 20\n   bytes, leading to zero-size allocations and divide-by-zero crashes.\n\n - Unsolicited status descriptors and fixed replies (such as struct\n   mpi3_iounit_control_reply, 64 bytes) require at least 16 dwords.\n\nValidate reply_frame_size in mpi3mr_issue_iocfacts() to ensure it is within\n[16, U16_MAX / 4] dwords before processing facts data.\n\nFixes: 824a156633df (\"scsi: mpi3mr: Base driver code\")\nCc: stable@vger.kernel.org\nSigned-off-by: Milan P. Gandhi \u003cmgandhi@redhat.com\u003e\nLink: https://patch.msgid.link/20261105122401.266559-1-mgandhi@redhat.com\nSigned-off-by: Martin K. Petersen (Oracle) \u003cmkp@kernel.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "d6e16707fd97c80536f6ff33c81dcd854ee21156",
      "old_mode": 33188,
      "old_path": "drivers/scsi/mpi3mr/mpi3mr.h",
      "new_id": "e78383df619c34ce175cfdad227d155e5bfa378a",
      "new_mode": 33188,
      "new_path": "drivers/scsi/mpi3mr/mpi3mr.h"
    },
    {
      "type": "modify",
      "old_id": "f0d3cd398dd00c59d6b7b1db77a56275336c814b",
      "old_mode": 33188,
      "old_path": "drivers/scsi/mpi3mr/mpi3mr_fw.c",
      "new_id": "60a92366e590492a28a3fb39d78dea32f23f1545",
      "new_mode": 33188,
      "new_path": "drivers/scsi/mpi3mr/mpi3mr_fw.c"
    }
  ]
}