Re: [PATCH v9 3/9] scsi: mvumi: bound the hotplug event bitmap

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] scsi: mvumi: missing endian conversion for param->size
--

commit 67e2f811bb5307d634893d7bcc1a4ae7f4bb47eb
Author: Yehyeong Lee <yhlee@isslab.korea.ac.kr>

scsi: mvumi: bound the hotplug event bitmap

This commit adds a bounds check to mvumi_proc_msg() to prevent scanning
past the allocated event buffer. It reads the size parameter from the
hotplug event and rejects events where the size exceeds expected limits.

> diff --git a/drivers/scsi/mvumi.c b/drivers/scsi/mvumi.c
> --- a/drivers/scsi/mvumi.c
> +++ b/drivers/scsi/mvumi.c
> @@ -1652,11 +1652,25 @@ static int mvumi_rescan_bus(void *data)
>  static void mvumi_proc_msg(struct mvumi_hba *mhba,
>  					struct mvumi_hotplug_event *param)
>  {
> -	u16 size = param->size;
> +	u16 size = READ_ONCE(param->size);

[Severity: Medium]
Does param->size require an endianness conversion like le16_to_cpu() here?

If the Marvell hardware writes the event buffer in little-endian format
during normal hotplug events, reading param->size natively on a big-endian
host would yield a heavily swapped value.

>  	const unsigned long *ar_bitmap;
>  	const unsigned long *re_bitmap;
>  	int index;
>  
> +	/*
> +	 * The second bitmap starts size bits into the event buffer and
> +	 * find_next_zero_bit() reads it a long at a time, so that is the
> +	 * furthest the two scans reach.  Bound it by the length the firmware
> +	 * was told it may write, not by the buffer: the bytes past that are
> +	 * still zero, and a zero bit here means a device is present.
> +	 */
> +	if (sizeof(*param) + (size >> 3) + BITS_TO_LONGS(size) * sizeof(long) >
> +			sizeof(struct mvumi_event_req)) {

[Severity: Medium]
Since the newly added bounds check in mvumi_proc_msg() relies on this
size value, would an incorrectly swapped size on big-endian hosts cause
this check to spuriously fail and reject valid hotplug events?

> +		dev_err(&mhba->pdev->dev,
> +			"invalid hotplug event bitmap size %u\n", size);
> +		return;
> +	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015045213.3975845-1-yhlee@isslab.korea.ac.kr?part=3