[PATCH 2/2] scsi: qedi: bound the sense data length reported by the firmware

[Yehyeong Lee]

qedi_scsi_completion() reads the sense length out of the CQE and uses it to
copy sense data out of the command's sense buffer:

	datalen = cqe_data_in->reserved2 &
		  ISCSI_COMMON_HDR_DATA_SEG_LEN_MASK;
	memcpy((char *)conn->data, (char *)cmd->sense_buffer, datalen);

That mask is 0xFFFFFF as well.  cmd->sense_buffer is a
SCSI_SENSE_BUFFERSIZE coherent DMA allocation and the firmware is only ever
given its address, so 96 bytes is all there is to read there, while
conn->data is the ISCSI_DEF_MAX_RECV_SEG_LEN buffer libiscsi allocates for
the connection.  A reported length above 96 reads past the sense buffer and
one above 8192 writes past conn->data, and datalen reaches
__iscsi_complete_pdu() afterwards, which reads it back out.  Every
SAM_STAT_CHECK_CONDITION completion takes this path.

Cap the length at the size of the buffer the firmware was pointed at.

Unlike the unsolicited path in the previous patch this one is not covered
by the KUnit harness, since reaching it needs a whole task and connection;
the bound here is just the size of the allocation the sense data is copied
out of.

Fixes: ace7f46ba5fd ("scsi: qedi: Add QLogic FastLinQ offload iSCSI driver framework.")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Yehyeong Lee <yhlee@xxxxxxxxxxxxxxxxxx>
---
diff --git a/drivers/scsi/qedi/qedi_fw.c b/drivers/scsi/qedi/qedi_fw.c
--- a/drivers/scsi/qedi/qedi_fw.c
+++ b/drivers/scsi/qedi/qedi_fw.c
@@ -640,8 +640,10 @@
 	hdr->residual_count = cpu_to_be32(cqe_data_in->residual_count);
 
 	if (hdr->cmd_status == SAM_STAT_CHECK_CONDITION) {
-		datalen = cqe_data_in->reserved2 &
-			  ISCSI_COMMON_HDR_DATA_SEG_LEN_MASK;
+		/* The firmware can only have filled the buffer it was given; cap at that. */
+		datalen = min_t(u32, cqe_data_in->reserved2 &
+				     ISCSI_COMMON_HDR_DATA_SEG_LEN_MASK,
+				SCSI_SENSE_BUFFERSIZE);
 		memcpy((char *)conn->data, (char *)cmd->sense_buffer, datalen);
 	}