Re: [PATCH v3] zfcp: Fix integer underflow in status read buffer payload length

[sashiko-bot@kernel.org]

> zfcp_dbf_hba_fsf_uss() only guards against a zero-length status read
> buffer. If srb->length is non-zero but smaller than the fixed header
> size of struct fsf_status_read_buffer, subtracting the payload offset
> underflows and can result in an out-of-bounds read from
> srb->payload.data.
> 
> zfcp_dbf_san_in_els() has the same problem. The underflowed value is
> used as the scatterlist payload length, potentially causing accesses
> beyond the reported status read buffer.
> 
> Prevent both underflows by validating srb->length before subtracting the
> payload offset. If the reported status read buffer length does not reach
> the payload area, treat the payload as empty rather than performing the
> subtraction. This avoids the unsigned underflow and ensures that no
> payload data is processed or accessed beyond the reported buffer.
> 
> Skip scatterlist setup and payload tracing when no valid payload exists.
> If the reported status read buffer length does not reach the payload
> area, no scatterlist is initialized and zfcp_dbf_san() is called
> without payload data, preventing any access beyond the reported buffer.
> 
> For valid payloads, preserve the existing tracing behavior by continuing
> to initialize the scatterlist and pass the computed payload length to
> zfcp_dbf_san().
> 
> Signed-off-by: Ajaykumar Rajappa <ajaykr@linux.ibm.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260924122400.1185067-1-ajaykr@linux.ibm.com?part=1