Re: [PATCH 2/2] scsi: mvumi: reject an out-of-range handshake frame length

[Yehyeong Lee]

Thanks for the review.

[High] double fetch: fixed in v2 -- the handshake frame_length is now read
once into a local that feeds both the bound check and the checksum, so the
device cannot change it in between:
  https://lore.kernel.org/linux-scsi/20261013173145.3412863-1-yhlee@xxxxxxxxxxxxxxxxxx/

[Medium] endianness: frame_length is a native u16; mvumi reads and writes it
without byte-swapping everywhere -- the existing mvumi_calculate_checksum()
calls and the driver's own frame_length stores -- and mvumi.h uses no __le
types.  The bound check follows that convention; converting only here would
disagree with how the field is used elsewhere.

[Medium] handshake abort: this patch already replaces the unbounded-length
infinite loop with a bounded rejection.  The remaining behaviour -- the
handshake timing out on an error return -- is the driver's existing recovery
path, shared with the checksum and page-code errors.  Making
mvumi_handshake_event() fail fast on that return would also abort the
FW_STATE_STARTING restart that mvumi_handshake() performs when the firmware
reports a non-OK status, so it is a separate change that needs the handshake
protocol semantics, not something to fold in here.