lib/mpi: Fix buffer overrun when SG is too long

stable inclusion
from stable-v5.10.173
commit 318dd6f5b7b401a7496e8474ed41a6a0e345afe1
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I8BFR3

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=318dd6f5b7b401a7496e8474ed41a6a0e345afe1



--------------------------------

[ Upstream commit 7361d1bc ]

The helper mpi_read_raw_from_sgl sets the number of entries in
the SG list according to nbytes.  However, if the last entry
in the SG list contains more data than nbytes, then it may overrun
the buffer because it only allocates enough memory for nbytes.

Fixes: 2d4d1eea ("lib/mpi: Add mpi sgl helpers")
Reported-by: Roberto Sassu <roberto.sassu@huaweicloud.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Reviewed-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: sanglipeng <sanglipeng1@jd.com>