[lvc-project] [PATCH] scsi: smartpqi: add safety checks for RAID 50/60 stripe size value

[Alexey Velichayshiy]

Add zero check for 'rmd->layout_map_count' and overflow check when
computing 'rmd->stripesize' as the product of 'rmd->blocks_per_row' and
'rmd->layout_map_count'. Using the check_mul_overflow() macro prevents
potential overflow of a 32-bit type, which could produce incorrect data in
subsequent calculations, including division-by-zero errors.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 6c223761eb54 ("smartpqi: initial commit of Microsemi smartpqi driver")
Signed-off-by: Alexey Velichayshiy <a.velichayshiy at ispras.ru>
---
 drivers/scsi/smartpqi/smartpqi_init.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
index fe549e2b7c94..42c2c137a819 100644
--- a/drivers/scsi/smartpqi/smartpqi_init.c
+++ b/drivers/scsi/smartpqi/smartpqi_init.c
@@ -2824,12 +2824,14 @@ static int pqi_calc_aio_r5_or_r6(struct pqi_scsi_dev_raid_map_data *rmd,
 	u64 tmpdiv;
 #endif
 
-	if (rmd->blocks_per_row == 0) /* Used as a divisor in many calculations */
+	/* Used as a divisors in many calculations */
+	if (rmd->blocks_per_row == 0 || rmd->layout_map_count == 0)
 		return PQI_RAID_BYPASS_INELIGIBLE;
 
 	/* RAID 50/60 */
 	/* Verify first and last block are in same RAID group. */
-	rmd->stripesize = rmd->blocks_per_row * rmd->layout_map_count;
+	if (check_mul_overflow(rmd->blocks_per_row, rmd->layout_map_count, &rmd->stripesize))
+		return PQI_RAID_BYPASS_INELIGIBLE;
 #if BITS_PER_LONG == 32
 	tmpdiv = rmd->first_block;
 	rmd->first_group = do_div(tmpdiv, rmd->stripesize);
-- 
2.43.0