Re: [PATCH v4] zfcp: Fix integer underflow in status read buffer payload length

[sashiko-bot@kernel.org]

> zfcp_dbf_hba_fsf_uss() only guards against a zero-length status read
> buffer. If srb->length is smaller than the fixed header size of
> struct fsf_status_read_buffer, subtracting the payload offset
> underflows and can lead to an out-of-bounds read.
> 
> zfcp_dbf_san_in_els() has the same issue, where the underflowed value
> is used as the scatterlist payload length.
> 
> Fix both cases by validating srb->length before subtracting the payload
> offset. If the reported buffer length does not reach the payload area,
> prevent payload access and treat the payload as empty.
> 
> For SAN tracing, retain the original channel-reported SRB length in the
> trace record when no valid payload area exists. This preserves trace
> evidence of anomalous firmware-reported lengths for serviceability,
> while using a capture length of zero to ensure that no payload data is
> accessed beyond the reported buffer.
> 
> For valid payloads, preserve the existing tracing behavior.
> 
> Fixes: a54ca0f62f95 ("[SCSI] zfcp: Redesign of the debug tracing for HBA records.")
> Fixes: 2c55b750a884 ("[SCSI] zfcp: Redesign of the debug tracing for SAN records.")
> Signed-off-by: Ajaykumar Rajappa <ajaykr@linux.ibm.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261005094631.3361197-1-ajaykr@linux.ibm.com?part=1