fc_fcp_resp() checks only the fixed response templates before using
device-declared response-info and sense lengths. A short response can
therefore pass the existing fixed-header check while the response-code
read or sense copy reaches beyond the current frame.

Validate the response-info span before reading its response code and
validate the combined response-info and sense spans before copying
sense data.

Fixes: 42e9a92fe6a9 ("[SCSI] libfc: A modular Fibre Channel library")
Cc: stable@vger.kernel.org
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 drivers/scsi/libfc/fc_fcp.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/scsi/libfc/fc_fcp.c b/drivers/scsi/libfc/fc_fcp.c
index a5139e43ca4c..6a1489be2617 100644
--- a/drivers/scsi/libfc/fc_fcp.c
+++ b/drivers/scsi/libfc/fc_fcp.c
@@ -882,6 +882,9 @@ static void fc_fcp_resp(struct fc_fcp_pkt *fsp, struct fc_frame *fp)
 				if ((respl != FCP_RESP_RSP_INFO_LEN4) &&
 				    (respl != FCP_RESP_RSP_INFO_LEN8))
 					goto len_err;
+				if (fsp->wait_for_comp &&
+				    plen < sizeof(*fc_rp) + sizeof(*rp_ex) + respl)
+					goto len_err;
 				if (fsp->wait_for_comp) {
 					/* Abuse cdb_status for rsp code */
 					fsp->cdb_status = fc_rp_info->rsp_code;
@@ -897,6 +900,8 @@ static void fc_fcp_resp(struct fc_fcp_pkt *fsp, struct fc_frame *fp)
 				snsl = ntohl(rp_ex->fr_sns_len);
 				if (snsl > SCSI_SENSE_BUFFERSIZE)
 					snsl = SCSI_SENSE_BUFFERSIZE;
+				if (plen < sizeof(*fc_rp) + sizeof(*rp_ex) + respl + snsl)
+					goto len_err;
 				memcpy(fsp->cmd->sense_buffer,
 				       (char *)fc_rp_info + respl, snsl);
 			}
-- 
2.43.0