Re: [PATCH v4] zfcp: Fix integer underflow in status read buffer payload length

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] scsi: zfcp: build failure due to stray non-breaking space
--

commit 2a8ab7a51f83082138fe5de204f20c12d0e7bf28
Author: Ajaykumar Rajappa <ajaykr@linux.ibm.com>

zfcp: Fix integer underflow in status read buffer payload length

This commit fixes an integer underflow in zfcp_dbf_hba_fsf_uss() and
zfcp_dbf_san_in_els() when srb->length is smaller than the fixed header
size, preventing an out-of-bounds read. It ensures payload access is skipped
if the buffer is too small, while maintaining the correct tracing semantics.

> diff --git a/drivers/s390/scsi/zfcp_dbf.c b/drivers/s390/scsi/zfcp_dbf.c
> index 81fb8af408e9c..d487e9bb15617 100644
> --- a/drivers/s390/scsi/zfcp_dbf.c
> +++ b/drivers/s390/scsi/zfcp_dbf.c

[ ... ]

> @@ -714,17 +716,34 @@ void zfcp_dbf_san_in_els(char *tag, struct zfcp_fsf_req *fsf)
>  	struct zfcp_dbf *dbf = fsf->adapter->dbf;
>  	struct fsf_status_read_buffer *srb =
>  		(struct fsf_status_read_buffer *) fsf->data;
> -	u16 length;
> +	u16 length, cap_length;
>  	struct scatterlist sg;
> +	const u32 pay_offset = offsetof(struct fsf_status_read_buffer, payload);
>  
>  	if (unlikely(!debug_level_enabled(dbf->san, ZFCP_DBF_SAN_LEVEL)))
>  		return;
>  
> -	length = (u16)(srb->length -
> -			offsetof(struct fsf_status_read_buffer, payload));
> -	sg_init_one(&sg, srb->payload.data, length);
> -	zfcp_dbf_san(tag, dbf, "san_els", &sg, ZFCP_DBF_SAN_ELS, length,
> -		     fsf->req_id, ntoh24(srb->d_id), length);
> +	if (srb->length < pay_offset) {
> +		/*
> +		 * Invalid buffer: record the reported SRB length in pl_len
> +		 * for tracing, but capture no payload.
> +		 */
> +		length = srb->length;
> +		cap_length = 0;
> +	} else {
> +		/*
> +		 * Valid buffer: record the payload length in pl_len
> +		 * and capture the payload.
> +		 */
> +		length = (u16)(srb->length - pay_offset);
> +		cap_length = length;
> + 
> +		sg_init_one(&sg, srb->payload.data, length);

[Severity: Low]
Does this code contain a stray non-breaking space character?

The blank line right above the sg_init_one() call in zfcp_dbf_san_in_els()
contains a non-breaking space (U+00A0). This will unconditionally cause a
compiler syntax error ('stray \302\240 in program') when building the
driver.

> +	}
> +
> +	zfcp_dbf_san(tag, dbf, "san_els", cap_length ? &sg : NULL,
> +		     ZFCP_DBF_SAN_ELS, length, fsf->req_id,
> +		     ntoh24(srb->d_id), cap_length);
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261005092357.2747395-1-ajaykr@linux.ibm.com?part=1