[PATCH 0/2] scsi: bnx2i: bound the payload lengths the chip reports

[Yehyeong Lee]

Three handlers in bnx2i take a payload length out of a completion queue
entry and use it without comparing it against the buffer it is read from or
the one it is written to.  All three fields are u32 and none of them is
masked.

The first patch covers the receive queue path, where bnx2i_get_rq_buf()
copies out of a single BNX2I_RQ_WQE_SIZE entry and the Reject handler asks
it for as much as the chip claims.  The second covers the login and text
response handlers, which put a write pointer at resp_buf + length and then
pad from there.

What makes these look like oversights rather than a decision to trust the
chip is that bnx2i_process_scsi_cmd_resp() caps the same field against both
of the sizes involved, with a separate error message for each, and has done
so since the driver was added in 2009.

I have no NetXtreme II hardware, so patch 1 is backed by a KUnit harness
that drives the real copy helper with the RQ ring and conn->data swapped
for kmalloc() of the same sizes so that KASAN can see them, and patch 2
rests on the sizes in the source.  Neither patch changes what is delivered
for a payload that fits in the buffer it was given.

Yehyeong Lee (2):
  scsi: bnx2i: bound the RQ payload length reported by the chip
  scsi: bnx2i: bound the login and text response payload length

 drivers/scsi/bnx2i/bnx2i.h     |  2 +-
 drivers/scsi/bnx2i/bnx2i_hwi.c | 29 ++++++++++++++++++++---------
 2 files changed, 21 insertions(+), 10 deletions(-)