Re: [PATCH v2] scsi: mvumi: reject handshake sizes that overflow the list allocations

[Yehyeong Lee]

Thanks -- v3 addresses the reset path; the find_first_bit() point is below.

- host reset: v3 rejects a reset handshake that reports sizes larger than the
  ones the buffers were allocated for.  mvumi_init_data() does not reallocate
  on reset, so mvumi_hs_process_page() now compares the new sizes against the
  current ones when MVUMI_FW_ALLOC is set and fails the handshake if any grew.
  The shift, list-depth and list_num_io checks already live in that function,
  so they applied on the reset path in v2 as well.
- find_first_bit(): this is in mvumi_hs_build_page(), which this patch does
  not change.  The 8-byte read on a 64-bit build covers list_num_io and the
  adjacent ib_max_size, both members of struct mvumi_hba, so it is a read of a
  neighbouring field rather than an out-of-bounds access.  It is pre-existing,
  and the only input that makes find_first_bit() scan past list_num_io's own
  bits -- list_num_io == 0 -- is rejected by the check this patch adds.