From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dy1-f180.google.com (mail-dy1-f180.google.com [74.125.82.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 540DB264A97 for ; Mon, 22 Jun 2026 17:42:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.180 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782150133; cv=none; b=Mzd/Uj4GRbAS7YrRmcc0+qYWhkePtWlDlhy2pmKatYD4p0bQndzUt0OgESyS6yTkSdnRtkm5f/Wr442vyE6e8dWJYwITavN1vQUIB/fIdsviuvxmaO0Ym9gN7Yb3sgGOBWUG7RFwG5Z6lhT34em5THWg6iuIZpuiV9DMPULbV/4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782150133; c=relaxed/simple; bh=QH3KrRoWJuIPfFyEQs+7l2o1gbngwfwlpX7zx4wi2yA=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=EcL0Tdmlrz6qfD9L4hvPL2Vm/Y9xUgNo0nMzOmCeIw6y3B62Md2iMk+EyiCVrz3gwtlMvR5CIgSa3y6gLMjvA4wvud4W8TDLj1xqf4a9zP5jggISqzCgsiiAvsSKWy7xW91r/38gba5dBU5ufzVIsi9l6lkwCv/obn12hVFZ1sw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=sdw3hmTD; arc=none smtp.client-ip=74.125.82.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="sdw3hmTD" Received: by mail-dy1-f180.google.com with SMTP id 5a478bee46e88-30beab3af9eso11325070eec.1 for ; Mon, 22 Jun 2026 10:42:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782150131; x=1782754931; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=ToB/8IE6VikY/NkfvlNd+aqZ/ZSWB+24gFF6ITZVopQ=; b=sdw3hmTDYJeyZQFv/dPIScq6KHCArOwTaEx4X5xjGJeRlOjA1BAH7bwFP5kMZwOf49 PXyYDOXh0xslbp1tydUfMbBGB8QGMT3+qI/J8gFHkT899LIX5UCtLQ0r3RAX5vblRStR 5YeoeiZr2mvuGCDyJDQ0t6aDzTa/rB8P1udqw6tHqEC4NTrpvwfjhmuD+bVU5Y+f0Zkb 8of/auXMW2zoqY/o1FZTPs7atWJhypypUC7GAvbAm2AOo8tAeT7RvOa5953VmTYb4cxk okDOO+IlSFTHuwVcszPV8w7FX57DmSRe2HyXojWnRBWozX7iTOiD4rXWYFNpLssy/aRW PqfQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782150131; x=1782754931; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=ToB/8IE6VikY/NkfvlNd+aqZ/ZSWB+24gFF6ITZVopQ=; b=o3LGG7UxrtqdL/6dMTQ/OOjTAv9wj4DzqH+aJnJOBHzfH0QnydT/JJNJQ3R31ho4I0 C5W/xZaW9DrK6m0g+ejkpqs1EiX6Uci88ciBxyF7cjYHz4VFldBwdhVDgCqNAGM4FUmd P+8bDvRIFkceTrBQpVKYjECWypjOa56CSOKwjftI1K/GFWU1qzu04fqjO4TklHqwLpCj cbr1dyrKLO3Fu7GjyPRj3Z9x/b0oKcraYxgDsZkN8dRHvz9kSj54vh3i4A9zxGlC+605 5m3VaTOXuoSx3SM7BZkxXsETAJ/bRFgvI/55ATSDXZU8Oi/3ufSeGRhyAVm7RFXWZGV2 pvQA== X-Forwarded-Encrypted: i=1; AHgh+RpaEb9LQGUR/ZSmK0uc0bqguE3JnUEY/rMcsceFGqLnr6s2MW7bmOolec92IZrJXULCwVthviaZg5ZFhhk=@vger.kernel.org X-Gm-Message-State: AOJu0YztipNLCtCxWPD546oDCq8TLR+D+e2QbP/Ov+CXsMT4JXDe5pb+ KXtIeUN2b+hKzCr5Y0GL5fvxVd1fgRSUNLkrurcBj+islB70Fo5+6XYs X-Gm-Gg: AfdE7cm71h2P9lEXew2QWtdpUAk/FrDjMkhfH0X12kAxNPJEif+VvUZ9/lO8ia/Ixz3 xRun+dIkQHcU67GxUVYR+07UU/HFgx/G9Ja59Wf09qSiaITM2spJyVB8QylpL9ErzPJS0cXxLx6 17SkL+r7N9+zhKFpGo4Z3l6dfSCH8cdeGX8OZmAjXb1K0ai+bEUHhwgQ8c67805JcV8r88ce4cD lkS+JHDNtQvLraCOIitKhLu7twJLja521q6qnF9LoOU4Cy1iA1PaEG+n3mqK/VjbJDy7YDbtbby 9hoEp2WEJwXtQJpxi4ubPY+QNHdE+vK3vazQW+i3OK9NVaaC4pSNzQd7YcI/Wq4Jn/7b0+CUYZl hVu48HkSu9EbcTMGJ6CU9oO1G+Khgtoh6wXiADc+QMiWll98jzQX/dxKUuZEDwzFnoo4DicwjQp 2PyTKWFbyDLZymLAz+5oeYgGy3sadyZ+w4CaU0ZLA2ALvSPfsVJE1i7KM5VX2jbJuKhw== X-Received: by 2002:a05:7300:5b89:b0:30b:f888:7821 with SMTP id 5a478bee46e88-30c070387a8mr11480846eec.28.1782150131326; Mon, 22 Jun 2026 10:42:11 -0700 (PDT) Received: from [10.69.76.39] ([192.19.223.252]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-30c1be5c5desm11114785eec.28.2026.06.22.10.42.10 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 22 Jun 2026 10:42:10 -0700 (PDT) Message-ID: <82be2f83-5454-47cb-8719-b259209a5e2b@gmail.com> Date: Mon, 22 Jun 2026 10:40:23 -0700 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: lpfc: unbounded QFPA response length in lpfc_cmpl_els_qfpa() To: Maoyi Xie , Justin Tee , Paul Ely Cc: "Martin K. Petersen" , linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org References: <178214622623.2376914.7843191393281628987@maoyixie.com> Content-Language: en-US From: Justin Tee In-Reply-To: <178214622623.2376914.7843191393281628987@maoyixie.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Hi Maoyi, > This runs when the VMID feature is negotiated. The attacker is a malicious > or compromised fabric switch or target answering the QFPA request. > > I reproduced the overflow on 7.1-rc7. I ran the same copy with a 1020 byte > qfpa_res buffer and a len that makes len + 8 larger than it. The copy runs > past the buffer and faults. Is it possible to provide the fabric switch and target hardware details, i.e. model and version numbers, used to reproduce this issue? > Does this look like a real bug to you, and is bounding len the right > approach? If so I am happy to send a proper patch with a Fixes tag and Cc > stable. No, this does not look like a real bug because the payload comes from an implicitly trusted source within the fabric.  Hence, it would be helpful to share switch and target details that this issue was found.  That said, we are already aware of this through AI security scan warnings and it will be addressed in a near lpfc version update. Regards, Justin