Re: [PATCH v6] scsi: zfcp: Fix out-of-bounds read of bogus status read buffer length in dbf

[sashiko-bot@kernel.org]

> zfcp_dbf_hba_fsf_uss() and zfcp_dbf_san_in_els() derive the payload
> length to trace from the channel supplied srb->length without checking
> it against the size of the status read buffer. A bogus srb->length makes
> the 16-bit pl_len wrap or exceed the payload array, so the trace code
> may read beyond srb->payload.data. In addition, the u16 pl_len cannot
> represent the original 32-bit srb->length, so the raw value is lost.
> 
> Add zfcp_dbf_srb_pl_len() to compute pl_len in one place, and use it in
> both trace functions. Check bounds on the full 32-bit srb->length and
> clamp the number of traced payload bytes to FSF_STATUS_READ_PAYLOAD_SIZE.
> An oversized length is thereby not dropped, the readable part is still
> traced.
> 
> If srb->length is neither 0 nor within header plus payload array size,
> additionally write the raw 32-bit value as a separate "fsf_len" pay
> [ ... ]
>    precedence over pl_len.
> 
> Fixes: a54ca0f62f95 ("[SCSI] zfcp: Redesign of the debug tracing for HBA records.")
> Fixes: 2c55b750a884 ("[SCSI] zfcp: Redesign of the debug tracing for SAN records.")
> Signed-off-by: Ajaykumar Rajappa <ajaykr@linux.ibm.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261013154041.393716-1-ajaykr@linux.ibm.com?part=1