Re: [PATCH 1/5] scsi: lpfc: Replace strlcat() with seq_buf in lpfc_info()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Unsafe lockless iteration over the `pdev->bus->devices` list causes use-after-free vulnerabilities.
--

--- Patch [1]: [PATCH 1/5] scsi: lpfc: Replace strlcat() with seq_buf in lpfc_info() ---
commit f8c11b7b237ed1d074a50074665c19f1c5567a78
Author: Ian Bridges <icb@fastmail.org>
Subject: scsi: lpfc: Replace strlcat() with seq_buf in lpfc_info()

This commit replaces strlcat() and intermediate buffers with the seq_buf API
in lpfc_info(). This simplifies string construction while maintaining memory
safety and silent truncation behavior.

Link: https://github.com/KSPP/linux/issues/370 [1]

> diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
> index f2cab134af7f1..8a795c65e3c3e 100644
> --- a/drivers/scsi/lpfc/lpfc_scsi.c
> +++ b/drivers/scsi/lpfc/lpfc_scsi.c
[ ... ]
> @@ -5103,57 +5104,37 @@ lpfc_info(struct Scsi_Host *host)
[ ... ]
>  		/* PCI resettable */
> -		if (!lpfc_check_pci_resettable(phba)) {
> -			scnprintf(tmp, sizeof(tmp), " PCI resettable");
> -			strlcat(lpfcinfobuf, tmp, sizeof(lpfcinfobuf));
> -		}
> +		if (!lpfc_check_pci_resettable(phba))

[Severity: High]
This isn't a bug introduced by this patch, but is it safe to call
lpfc_check_pci_resettable() without holding the pci_bus_sem read lock?

Looking at lpfc_check_pci_resettable() in drivers/scsi/lpfc/lpfc_scsi.c,
it iterates over the pdev->bus->devices list:

drivers/scsi/lpfc/lpfc_scsi.c:lpfc_check_pci_resettable() {
    ...
	/* Walk the list of devices on the pci_dev's bus */
	list_for_each_entry(ptr, &pdev->bus->devices, bus_list) {
		/* Check for Emulex Vendor ID */
    ...
}

If a concurrent PCI hot-remove operation occurs, could the bus_list pointers
be freed while list_for_each_entry is following the next pointer, leading
to a use-after-free?

> +			seq_buf_printf(&s, " PCI resettable");
>  	}
>  
> -buffer_done:
>  	return lpfcinfobuf;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260729144617.1388646-1-icb@fastmail.org?part=1