scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker

In the Linux kernel, the following vulnerability has been resolved:

scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker

drivers/scsi/fcoe/fcoe_ctlr.c::fcoe_ctlr_recv_clr_vlink() advanced the

descriptor cursor by an attacker-supplied fip_dlen without ever

requiring dlen >= sizeof(struct fip_desc) in the default branch. The

named descriptor cases (FIP_DT_MAC, FIP_DT_NAME, FIP_DT_VN_ID) checked

their per-type minimum lengths, but a FIP_DT_NON_CRITICAL descriptor

(fip_dtype >= 128, which the standard requires receivers to silently

ignore) skipped that check entirely.

An unauthenticated L2 peer on the FCoE control VLAN could hang

fcoe_ctlr_recv_work on an fcoe, qedf, or bnx2fc initiator indefinitely

by emitting one FIP CVL frame whose single descriptor had fip_dtype ==

FIP_DT_NON_CRITICAL and fip_dlen == 0: the cursor advanced zero bytes

per iteration and the loop condition rlen >= sizeof(*desc) stayed true

forever, blocking every subsequent FIP frame on that controller.

Tighten the outer dlen guard to also reject dlen < sizeof(struct

fip_desc), so a malformed descriptor whose length cannot even cover the

descriptor header is rejected before the switch. This is the same

lower-bound the named cases already apply and is the minimum scope that

closes the loop.