Re: [PATCH v2 2/2] scsi: mvumi: reject an out-of-range handshake frame length

[Yehyeong Lee]

Thanks for the re-review.

I answered the endianness and handshake-abort points on the v1 thread --
briefly: frame_length is a native u16 that the driver reads and writes
without byte-swapping everywhere, and the error return matches the existing
checksum/page-code paths while this patch already replaces the infinite
loop with a bounded rejection:
  https://lore.kernel.org/linux-scsi/20261013173536.3414059-1-yhlee@xxxxxxxxxxxxxxxxxx/

On the two new points:

- READ_ONCE: v2 already compiles to a single load of frame_length here (the
  bound check and the checksum use the same register), so the double fetch
  is not present in the object code.  I can wrap the read in READ_ONCE() to
  guarantee that at the language level if you prefer.
- allocation sizing: you are right -- max_io and the cl_in/out entry sizes
  from the handshake page feed an unchecked multiply in mvumi_init_data()
  and can under-allocate.  That is a separate bug from the frame_length
  bound in this patch; I will address it in its own patch.