Re: [PATCH v5 2/3] scsi: bfa: drop unsolicited frames shorter than the headers they must hold

[Yehyeong Lee]

On the 24-byte case: a frame of exactly sizeof(struct fchs_s) passes the new
guard, and the dispatch then reads els_cmd->els_code at offset 24. For such a
frame that byte is past the frame, but it is still inside the unsolicited-frame
buffer, which is a fixed sizeof(struct bfa_uf_buf_s) that claim_uf_post_msgs()
posts and patch 1 clamps the length to -- so this is a stale in-buffer read,
not an out-of-bounds access. The two handlers that use the length,
bfa_fcs_lport_echo() and bfa_fcs_lport_scn_process_rscn(), are both bounded at
24 bytes (pyld_len == 0, so the memcpy does not run; max_entries == 0, so the
walk does not run).

The minimum cannot be raised to also cover the ELS command word, because a
24-byte header-only frame is legitimate: ABTS is a Basic Link Service frame
with no payload and is dispatched from bfa_fcs_lport_uf_recv() at exactly
sizeof(struct fchs_s). Requiring more would drop valid ABTS frames.

Checking each ELS/BLS against its own minimum payload length is a separate
change; this series bounds the frame length itself -- the FC header below, the
posted buffer above -- and the two handlers that consume it.

Yehyeong