Re: [PATCH 28/37] scsi: mvumi: use 16-bits defined sense codes

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Unhandled dma_map_sg failure in mvumi_make_sgl
--

commit 741665dea239f5c02068d60c93684dd2fc4d00e6
Author: Damien Le Moal <dlemoal@kernel.org>

scsi: mvumi: use 16-bits defined sense codes

This refactors the Marvell UMI driver to use scsi_set_sense() and replaces
all hard-coded additional sense codes and additional sense code qualifiers
with the enum values defined in include/scsi/scsi_sense.h to improve code
clarity.

> diff --git a/drivers/scsi/mvumi.c b/drivers/scsi/mvumi.c
> index e70d336b4ab39..a5bd3258a3994 100644
> --- a/drivers/scsi/mvumi.c
> +++ b/drivers/scsi/mvumi.c
> @@ -2067,7 +2067,7 @@ static unsigned char mvumi_build_frame(struct mvumi_hba *mhba,
>  	return 0;
>  
>  error:
> -	scsi_build_sense(scmd, 0, ILLEGAL_REQUEST, 0x24, 0);
> +	scsi_set_sense(scmd, 0, ILLEGAL_REQUEST, INVALID_FIELD_IN_CDB);

[Severity: High]
This isn't a bug introduced by this patch, but there is a pre-existing issue
in the error handling path leading here.

In mvumi_make_sgl(), which is called just before the error label, if
dma_map_sg() fails it returns 0. However, mvumi_make_sgl() incorrectly
checks for failure by checking if the returned count is greater than max_sge:

drivers/scsi/mvumi.c:mvumi_make_sgl() {
...
	*sg_count = dma_map_sg(&mhba->pdev->dev, scsi_sglist(scmd), sgnum,
			       scmd->sc_data_direction);
	if (*sg_count > mhba->max_sge) {
...
}

Since 0 is not greater than max_sge, the check is bypassed. mvumi_make_sgl()
then skips the scatterlist loop and incorrectly returns 0 (success).

mvumi_build_frame() proceeds to pass the command to the firmware with a
non-zero data_transfer_length (from scsi_bufflen) but 0 scatter-gather
entries.

Could this crash or wedge the Marvell UMI firmware by sending a malformed
command?

>  	return -1;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831020451.585944-1-dlemoal@kernel.org?part=28