[PATCH v4 2/3] scsi: bfa: drop unsolicited frames shorter than their VFT header

[Yehyeong Lee]

bfa_fcs_uf_recv() keeps the received frame length in a u16 and, for a
frame that carries a virtual fabric tagging header, steps over that
header:

	fchs = (struct fchs_s *) (vft + 1);
	len -= sizeof(struct fc_vft_s);

Nothing has checked that the frame is long enough to hold the header it
says it has. A frame too short to hold its own VFT header makes the
subtraction wrap, so len comes out near 65530 instead of going negative,
and that length is what bfa_fcs_fabric_uf_recv() and
bfa_fcs_lport_uf_recv() then hand to every ELS handler. Any of them that
believes it reads up to 64 kB past the frame buffer.

Drop the frame instead, the same way the block right above drops a frame
whose virtual fabric id is unknown.

Fixes: 7725ccfda597 ("[SCSI] bfa: Brocade BFA FC SCSI driver")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Yehyeong Lee <yhlee@xxxxxxxxxxxxxxxxxx>
---
 drivers/scsi/bfa/bfa_fcs.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/scsi/bfa/bfa_fcs.c b/drivers/scsi/bfa/bfa_fcs.c
index 9b57312f43f50..711d2ed83a7aa 100644
--- a/drivers/scsi/bfa/bfa_fcs.c
+++ b/drivers/scsi/bfa/bfa_fcs.c
@@ -1552,6 +1552,11 @@ bfa_fcs_uf_recv(void *cbarg, struct bfa_uf_s *uf)
 		/*
 		 * skip vft header
 		 */
+		if (len < sizeof(struct fc_vft_s)) {
+			bfa_uf_free(uf);
+			return;
+		}
+
 		fchs = (struct fchs_s *) (vft + 1);
 		len -= sizeof(struct fc_vft_s);
 
-- 
2.43.0