Re: [PATCH v3 3/3] scsi: arcmsr: wrap the type B completion index before using it

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] scsi: arcmsr: infinite loop in ISR processing due to unbounded hardware DMA
--

commit 728fbf206bd1c95a2cfbe31aec39150fac1e1356
Author: Yehyeong Lee <yhlee@isslab.korea.ac.kr>

scsi: arcmsr: wrap the type B completion index before using it

This commit fixes a KASAN slab-out-of-bounds issue in arcmsr_hbaB_postqueue_isr
and arcmsr_hbaB_polling_ccbdone by wrapping the doneq_index with
ARCMSR_MAX_HBB_POSTQUEUE before it is used to index into done_qbuffer[].

> diff --git a/drivers/scsi/arcmsr/arcmsr_hba.c b/drivers/scsi/arcmsr/arcmsr_hba.c
> index e635b76daae9a..d13bd0febb81a 100644
> --- a/drivers/scsi/arcmsr/arcmsr_hba.c
> +++ b/drivers/scsi/arcmsr/arcmsr_hba.c
> @@ -2568,7 +2568,7 @@ static void arcmsr_hbaB_postqueue_isr(struct AdapterControlBlock *acb)
>  	bool error;
>  	unsigned long cdb_phy_addr;
>  
> -	index = reg->doneq_index;
> +	index = reg->doneq_index % ARCMSR_MAX_HBB_POSTQUEUE;
>  	while ((flag_ccb = reg->done_qbuffer[index]) != 0) {

[Severity: Medium]
Could this loop spin infinitely? The loop condition depends entirely on
hardware-controlled DMA memory without an iteration limit.

If a faulty or malicious PCIe device continuously populates the DMA-mapped
done_qbuffer faster than the CPU processes it, or supplies an endless stream
of non-zero completions, can this lead to a CPU soft or hard lockup?

>  		cdb_phy_addr = (flag_ccb << 5) & 0xffffffff;
>  		if (acb->cdb_phyadd_hipart)

[ ... ]

> @@ -3671,7 +3671,7 @@ static int arcmsr_hbaB_polling_ccbdone(struct AdapterControlBlock *acb,
>  	/* clear doorbell interrupt */
>  	writel(ARCMSR_DOORBELL_INT_CLEAR_PATTERN, reg->iop2drv_doorbell);
>  	while(1){
> -		index = reg->doneq_index;
> +		index = reg->doneq_index % ARCMSR_MAX_HBB_POSTQUEUE;
>  		flag_ccb = reg->done_qbuffer[index];
>  		if (flag_ccb == 0) {

[Severity: Medium]
Could this polling loop also lack a structural bound and spin infinitely?

If the hardware continuously supplies non-zero completions, poll_count is only
evaluated when flag_ccb == 0. Can this result in a denial of service if the
hardware never returns a zero completion?

>  			if (poll_ccb_done){

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1791803953.git.yhlee@isslab.korea.ac.kr?part=3