Re: [PATCH] scsi: zfcp: bound the RSCN page walk to the status read payload

[sashiko-bot@kernel.org]

> zfcp_fc_incoming_rscn() takes the number of RSCN pages from rscn_plen in
> the received ELS and walks that many four byte pages out of the status
> read buffer payload. The fabric chooses rscn_plen, it is a 16 bit field,
> and nothing compares it against the payload. A value of 65535 gives 16383
> entries, so the loop reads up to 65532 bytes out of a payload of
> FSF_STATUS_READ_PAYLOAD_SIZE, which is 4032. The status read buffer is a
> single page and its payload ends at the page boundary, so the walk
> continues into whatever follows that page.
> 
> Every iteration also hands the four bytes it just read to
> zfcp_fc_enqueue_event(), and that event reaches user space through
> fc_host_post_event(), so the bytes past the payload are reported and not
> merely read.
> 
> libfc bounds the same field. fc_disc_recv_rscn_req() refuses an RSCN whose
> [ ... ]
> payload size.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261023022056.3106651-1-yhlee@isslab.korea.ac.kr?part=1