Re: [PATCH] scsi: megaraid_sas: fix PRP list out-of-bounds write

Hi all, 

Confirming another reproduction of this bug on a sibling Broadcom controller and adding our data points to this thread.

Hardware
- HPE ProLiant DL360 Gen11 (Intel Xeon Gold 6442Y, Sapphire Rapids)
- HPE MR408i-o Gen11 controller (megaraid_sas, firmware 52.36.3-6584, the latest GA available via HPE SPP 2026.01)
- 4x Samsung PM9A3 NVMe behind controller in passthru mode
- Linux 6.18.32 (Talos v1.12.8)
- Workload: Rook-Ceph OSDs (heavy async direct I/O via io_submit)


Captured kernel panic via iLO Virtual Serial Port Log:

    [74.882646] sd 0:2:1:0: [sda] tag#1959 page boundary ptr_sgl: 0x000000006dccb64d
    [74.890125] BUG: unable to handle page fault for address: ff5cc2eaa115c000
    [74.918324] CPU: 40 ... Comm: tp_osd_tp Tainted: G S 6.18.32-talos
    [74.932153] Hardware name: HPE ProLiant DL360 Gen11, BIOS 2.84 04/02/2026
    [74.940813] RIP: 0010:megasas_build_and_issue_cmd_fusion+0xee3/0x1910 [megaraid_sas]
    [75.041116]  scsi_queue_rq+0x3ce/0xb80
    [75.044887]  blk_mq_dispatch_rq_list+0x12b/0x770
    [75.089402]  __x64_sys_io_submit+0xd7/0x190
    [75.355880] Kernel panic - not syncing: Fatal exception

The +0xee3 offset is byte identical to Lukasz’s original reproduction and Daniel’s MR416i-o Gen11 capture. It is the same compiled driver function failing at the same address.

Daniel, do you have any update on the SG-advance path you flagged in the test April 2? Happy to retest on our MR408i-o Gen11 setup.

Broadcom, could we get a review of Lukasz’s patch and look into whether the sg_next() / sg_dma_address() / sg_dma_len() also needs guarding? This reproduces on several HPE Gen11 MR-series with NVMe pass thru workloads on kernel 6.14+, and latest HPE firmware does not address it. Downstream tracking: siderolabs/talos#13630.

Thanks,
Mats