[PATCH] scsi: qla2xxx: Fix buffer overrun in login template

From: Cao Guanghui <[email protected]>

In qla_get_login_template(), 'q' points to plogi_els_payld.fl_csp
(offset 4), but the copy length is sizeof(struct fc_els_flogi) = 152
bytes. This makes cpu_to_be32_array() write 4 bytes past the end of
plogi_els_payld, corrupting the adjacent struct member.

Fix by pointing 'q' to the start of plogi_els_payld (offset 0), so the
152-byte copy fits exactly. The transfer length passed to firmware is
unchanged, so firmware compatibility is preserved.

The written bytes at offset 0-3 are never consumed: the only consumers
read from offsetof(fl_csp) onward (148 bytes) - qla_iocb.c copies via
offsetof(fl_csp) and qla_os.c reads fl_csp.sp_bb_cred. This contract was
clarified/normalized by commit 134f66959cd0 ("scsi: qla2xxx: Silence a
static checker warning"), which adjusted the read-side handling and
silenced static checker warnings. Moving q to the start of the struct
therefore does not affect any reader.

Fixes: 44f5a37d1e3e ("scsi: qla2xxx: Fix buffer-buffer credit extraction error")
Signed-off-by: Cao Guanghui <[email protected]>
---
 drivers/scsi/qla2xxx/qla_init.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index e746c9274cde..7e50cff79b5c 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -5666,7 +5666,7 @@ static void qla_get_login_template(scsi_qla_host_t *vha)
 		       "PLOGI ELS param read fail.\n");
 		return;
 	}
-	q = (__be32 *)&ha->plogi_els_payld.fl_csp;
+	q = (__be32 *)&ha->plogi_els_payld;
 
 	bp = (uint32_t *)ha->init_cb;
 	cpu_to_be32_array(q, bp, sz / 4);
-- 
2.25.1