In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound i2c->length in I2C bsg handlers struct qla_i2c_ac

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Bound i2c->length in I2C bsg handlers

struct qla_i2c_access carries a 16-bit length field alongside a fixed
64-byte buffer:

 1struct qla_i2c_access {
 2	uint16_t device, offset, option, length;
 3	uint8_t  buffer[0x40];
 4} __packed;

qla2x00_write_i2c() and qla2x00_read_i2c() use the user-supplied
i2c->length without any bounds check. i2c is overlaid on a 256-byte
on-stack buffer and sfp is a 256-byte DMA-pool buffer, so a length up to
65535 overruns both:

• write: memcpy(sfp, i2c->buffer, i2c->length) over-reads the stack and
  over-writes the sfp heap buffer, and qla2x00_write_sfp() then DMAs
  i2c->length bytes out of the 256-byte buffer.
• read: qla2x00_read_sfp() DMAs i2c->length bytes into the 256-byte sfp,
  then memcpy(i2c->buffer, sfp, i2c->length) overflows the 64-byte
  buffer inside the on-stack array.

A caller holding CAP_SYS_RAWIO can use this to corrupt the heap and the
kernel stack. Reject requests whose length exceeds the buffer before any
copy or DMA transfer in both handlers.