Re: [PATCH v3 54/57] scsi: sym53c8xx_2: Enable lock context analysis

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Unconditional NULL pointer dereference (Undefined Behavior) in bnx2fc_process_cq_compl due to __assume_ctx_lock on uninitialized cb_arg pointer.
--

--- Patch [54]: [PATCH v3 54/57] scsi: sym53c8xx_2: Enable lock context analysis ---
commit 914539bc4256a83053d649d7450d8f075fb16ba8
Author: Bart Van Assche <bvanassche@acm.org>

scsi: bnx2fc: Enable lock context analysis

This commit adds lock context analysis to the bnx2fc driver. It documents
locking requirements using __must_hold() and informs the compiler about
aliases for synchronization objects with __assume_ctx_lock().

> diff --git a/drivers/scsi/bnx2fc/bnx2fc_hwi.c b/drivers/scsi/bnx2fc/bnx2fc_hwi.c
> index a5ecb87d5b2d7..a3670c48900ba 100644
> --- a/drivers/scsi/bnx2fc/bnx2fc_hwi.c
> +++ b/drivers/scsi/bnx2fc/bnx2fc_hwi.c
> @@ -880,6 +880,9 @@ void bnx2fc_process_cq_compl(struct bnx2fc_rport *tgt, u16 wqe,
>  		return;
>  	}
>  
> +	/* Tell the compiler that there is an alias for tgt->tgt_lock. */
> +	__assume_ctx_lock(&io_req->cb_arg->aborted_io_req->tgt->tgt_lock);

[Severity: High]
Does this code trigger a NULL pointer dereference for standard SCSI
completions?

Looking at bnx2fc_process_cq_compl(), io_req->cb_arg is only allocated for ELS
or sequence cleanup commands. For standard FCoE SCSI completions
(BNX2FC_SCSI_CMD), io_req->cb_arg is NULL.

Since __assume_ctx_lock evaluates its argument to a pointer, evaluating this
nested pointer chain requires fetching the aborted_io_req pointer from the
memory addressed by cb_arg. Because cb_arg is NULL, this forces an invalid
memory read.

Can this be unconditionally reached on every SCSI completion, causing a hard
crash or triggering UndefinedBehaviorSanitizer warnings during normal I/O?

> +
>  	/* Timestamp IO completion time */
>  	cmd_type = io_req->cmd_type;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1785451174.git.bvanassche@acm.org?part=54