Hi Michael,
There are already current plans to address this concern in an upcoming
lpfc version update. Please stay tuned when we post the version
update.
Regards,
Justin
On Thu, Jul 9, 2026 at 7:30 PM Michael Bommarito
<michael.bommarito@gmail.com> wrote:
>
> An adjacent Fibre Channel fabric peer or device can crash an LPFC host
> with a malformed EDC ELS frame. lpfc_els_rcv_edc() trusts the EDC
> descriptor-list length from the received frame without checking that it
> fits in the actual ELS payload, so a short frame with an oversized
> descriptor-list length walks the TLV list past the receive buffer and
> trips a KASAN slab-out-of-bounds read in the ELS receive path.
>
> Patch 1 passes the received payload length into lpfc_els_rcv_edc(),
> rejects truncated EDC headers and descriptor lists larger than the
> payload, and avoids logging a third payload word unless it is present.
> Patch 2 adds same-translation-unit KUnit/KASAN coverage: a benign EDC
> frame that must still parse and the malformed frame that must now be
> rejected.
>
> Reproduced with the KUnit/KASAN test on f5459048c38a: stock trips
> BUG: KASAN: slab-out-of-bounds in lpfc_els_rcv_edc after the benign
> control passes; patched rejects the frame and both cases pass.
>
> Cc: stable@vger.kernel.org
>
> Michael Bommarito (2):
> scsi: lpfc: bound EDC descriptor list by payload length
> scsi: lpfc: add KUnit coverage for EDC descriptor bounds
>
> drivers/scsi/Kconfig | 7 ++
> drivers/scsi/lpfc/lpfc_els.c | 195 ++++++++++++++++++++++++++++++++---
> 2 files changed, 189 insertions(+), 13 deletions(-)
>
> --
> 2.53.0
>