Re: [PATCH v5 1/6] scsi: mvumi: bound the per-event parameter and sense dumps

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] scsi: mvumi: missing endianness conversion for firmware event fields
--

commit edf8fe53e2e86275574e11fc999d2a119ef7acd5
Author: Yehyeong Lee <yhlee@isslab.korea.ac.kr>

scsi: mvumi: bound the per-event parameter and sense dumps

This commit adds bounds checking to the event parameter and sense data
loops in mvumi_show_event() to prevent out-of-bounds reads when printing
firmware events to the system log.

> diff --git a/drivers/scsi/mvumi.c b/drivers/scsi/mvumi.c
> index e70d336b4ab39..38a92f8c25f5b 100644
> --- a/drivers/scsi/mvumi.c
> +++ b/drivers/scsi/mvumi.c
> @@ -1361,7 +1361,8 @@ static void mvumi_show_event(struct mvumi_hba *mhba,
>  	if (ptr->param_count) {
>  		printk(KERN_WARNING "Event param(len 0x%x): ",
>  						ptr->param_count);
> -		for (i = 0; i < ptr->param_count; i++)
> +		for (i = 0; i < ptr->param_count &&
> +		     i < ARRAY_SIZE(ptr->params); i++)
>  			printk(KERN_WARNING "0x%x ", ptr->params[i]);

[Severity: Medium]
As this patch modifies the parameter array loop in mvumi_show_event(), does
this code miss an endianness conversion when reading from the hardware DMA
buffer?

The u32 parameter fields from the event payload (ptr->params[i]) are
printed natively. On Big-Endian architectures, this could lead to
byte-swapped values appearing in the system logs whenever the firmware
reports an event.

Additionally, just prior to this loop in mvumi_show_event(), other
multi-byte fields from the hardware event structure (sequence_no, event_id,
and device_id) are also printed natively. Can these fields cause garbage
values to be logged on Big-Endian systems if they are not converted using
functions like le32_to_cpu() or le16_to_cpu()?

>  
>  		printk(KERN_WARNING "\n");

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261014151914.3632701-1-yhlee@isslab.korea.ac.kr?part=1