scsi: scsi_transport_fc: Reject truncated FPIN payloads

fc_host_fpin_rcv() computes the length of the TLV area as:

  bytes_remain = fpin_len - offsetof(struct fc_els_fpin, fpin_desc);

without checking that the payload is at least as large as the fixed FC-ELS
header.  For fpin_len smaller than the header size the subtraction
underflows to a huge u32, and the min_t() on the next line also reads
fpin->desc_len at offset 4, which is outside the payload when fpin_len is 4
or less.  The TLV walker then parses memory that is not part of the FPIN.

Reject payloads that cannot hold the header: there is no descriptor list to
parse and no statistics to update.  This is not only defensive: qla2xxx
forwards the firmware-provided frame size minus the 24-byte PURX ELS
header, so a frame of exactly that size reaches this helper with a zero
length.  fpin_len is supplied by the LLDD and the helper is exported, so it
should not assume a minimum.

Fixes: 3dcfe0de5a97 ("scsi: fc: Parse FPIN packets and update statistics")
Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
Link: https://patch.msgid.link/20261031222243820vSs-SXTIpNSHpWeC2dJ38@zte.com.cn
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>

0 files changed, 0 insertions, 0 deletions