Re: [PATCH v2 36/60] scsi: qla2xxx: Add abort command handling for 29xx series

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] Type-bounds violation in memset() causes static analysis warnings.
--

commit 1b38e59bc3182cc17053adca01767c3b67880da0
Author: Nilesh Javali <njavali@marvell.com>

scsi: qla2xxx: Add abort command handling for 29xx series

This commit extends the abort-IOCB code path to support the 29xx extended
abort_entry_24xx_ext structure alongside the existing abort_entry_24xx.
It widens function signatures to accept void pointers and updates memset
operations to use the appropriate ring-slot size.

> diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
> --- a/drivers/scsi/qla2xxx/qla_iocb.c
> +++ b/drivers/scsi/qla2xxx/qla_iocb.c
> @@ -3866,32 +3866,50 @@ qla82xx_start_scsi(srb_t *sp)
>  static void
> -qla24xx_abort_iocb(srb_t *sp, struct abort_entry_24xx *abt_iocb)
> +qla24xx_abort_iocb(srb_t *sp, void *pkt)
>  {
>  	struct srb_iocb *aio = &sp->u.iocb_cmd;
>  	scsi_qla_host_t *vha = sp->vha;
> +	struct qla_hw_data *ha = vha->hw;
>  	struct req_que *req = sp->qpair->req;
>  	srb_t *orig_sp = sp->cmd_sp;
> +	struct abort_entry_24xx *abt = pkt;
>  
> -	memset(abt_iocb, 0, sizeof(struct abort_entry_24xx));
> +	/*
> +	 * abort_entry_24xx_ext overlays abort_entry_24xx through
> +	 * req_que_no (offsets 0-17).  After that the layouts diverge:
> +	 * the 24xx variant has 30 bytes of reserved_1 followed by
> +	 * port_id[3] and a u8 vp_index at offsets 48-51, while the
> +	 * ext variant places a __le16 vp_index at offset 18 and has
> +	 * no port_id field.  Common-header writes go through one
> +	 * struct abort_entry_24xx * view; only port_id / vp_index
> +	 * branch on stride.
> +	 */
> +	memset(abt, 0, qla_req_entry_size(ha));

[Severity: Low]
Does this memset cause static analysis or compiler warnings regarding buffer
overflows?

The abt pointer is statically typed as struct abort_entry_24xx which is 64
bytes, but qla_req_entry_size(ha) can return 128 bytes for 29xx hardware.

While the underlying memory from pkt is correctly sized at 128 bytes and
won't cause a runtime memory safety issue, writing past the static type
bounds of abt can trigger -Wstringop-overflow warnings. Would it be better
to use the untyped pkt pointer for the memset instead?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260612095333.1666592-1-njavali@marvell.com?part=36