[PATCH 0/2] scsi: lpfc: bound EDC descriptor TLV walk

Michael Bommarito posted 2 patches 2 weeks, 1 day ago
drivers/scsi/Kconfig         |   7 ++
drivers/scsi/lpfc/lpfc_els.c | 195 ++++++++++++++++++++++++++++++++---
2 files changed, 189 insertions(+), 13 deletions(-)
[PATCH 0/2] scsi: lpfc: bound EDC descriptor TLV walk
Posted by Michael Bommarito 2 weeks, 1 day ago
An adjacent Fibre Channel fabric peer or device can crash an LPFC host
with a malformed EDC ELS frame. lpfc_els_rcv_edc() trusts the EDC
descriptor-list length from the received frame without checking that it
fits in the actual ELS payload, so a short frame with an oversized
descriptor-list length walks the TLV list past the receive buffer and
trips a KASAN slab-out-of-bounds read in the ELS receive path.

Patch 1 passes the received payload length into lpfc_els_rcv_edc(),
rejects truncated EDC headers and descriptor lists larger than the
payload, and avoids logging a third payload word unless it is present.
Patch 2 adds same-translation-unit KUnit/KASAN coverage: a benign EDC
frame that must still parse and the malformed frame that must now be
rejected.

Reproduced with the KUnit/KASAN test on f5459048c38a: stock trips
BUG: KASAN: slab-out-of-bounds in lpfc_els_rcv_edc after the benign
control passes; patched rejects the frame and both cases pass.

Cc: stable@vger.kernel.org

Michael Bommarito (2):
  scsi: lpfc: bound EDC descriptor list by payload length
  scsi: lpfc: add KUnit coverage for EDC descriptor bounds

 drivers/scsi/Kconfig         |   7 ++
 drivers/scsi/lpfc/lpfc_els.c | 195 ++++++++++++++++++++++++++++++++---
 2 files changed, 189 insertions(+), 13 deletions(-)

--
2.53.0
Re: [PATCH 0/2] scsi: lpfc: bound EDC descriptor TLV walk
Posted by Justin Tee 2 weeks, 1 day ago
Hi Michael,

There are already current plans to address this concern in an upcoming
lpfc version update.  Please stay tuned when we post the version
update.

Regards,
Justin

On Thu, Jul 9, 2026 at 7:30 PM Michael Bommarito
<michael.bommarito@gmail.com> wrote:
>
> An adjacent Fibre Channel fabric peer or device can crash an LPFC host
> with a malformed EDC ELS frame. lpfc_els_rcv_edc() trusts the EDC
> descriptor-list length from the received frame without checking that it
> fits in the actual ELS payload, so a short frame with an oversized
> descriptor-list length walks the TLV list past the receive buffer and
> trips a KASAN slab-out-of-bounds read in the ELS receive path.
>
> Patch 1 passes the received payload length into lpfc_els_rcv_edc(),
> rejects truncated EDC headers and descriptor lists larger than the
> payload, and avoids logging a third payload word unless it is present.
> Patch 2 adds same-translation-unit KUnit/KASAN coverage: a benign EDC
> frame that must still parse and the malformed frame that must now be
> rejected.
>
> Reproduced with the KUnit/KASAN test on f5459048c38a: stock trips
> BUG: KASAN: slab-out-of-bounds in lpfc_els_rcv_edc after the benign
> control passes; patched rejects the frame and both cases pass.
>
> Cc: stable@vger.kernel.org
>
> Michael Bommarito (2):
>   scsi: lpfc: bound EDC descriptor list by payload length
>   scsi: lpfc: add KUnit coverage for EDC descriptor bounds
>
>  drivers/scsi/Kconfig         |   7 ++
>  drivers/scsi/lpfc/lpfc_els.c | 195 ++++++++++++++++++++++++++++++++---
>  2 files changed, 189 insertions(+), 13 deletions(-)
>
> --
> 2.53.0
>