All of lore.kernel.org
 help / color / mirror / Atom feed
From: sashiko-bot@kernel.org
To: "Dave Marquardt" <davemarq@linux.ibm.com>
Cc: linux-scsi@vger.kernel.org
Subject: Re: [PATCH v14 03/11] scsi: ibmvfc: fix potential NULL pointer dereference on failed queue allocation
Date: Thu, 15 Oct 2026 15:20:49 +0000	[thread overview]
Message-ID: <sashiko-outbox-173054@kernel.org> (raw)
In-Reply-To: <20261015-ibmvfc-fpin-support-v14-3-a0b063b8d825@linux.ibm.com>

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] scsi: ibmvfc: Build failure due to un-guarded KUnit visibility macros
--

commit 79ff3803bf62c41db84d726eab4c3cdbd582546c
Author: Tyrel Datwyler <tyreld@linux.ibm.com>

scsi: ibmvfc: fix potential NULL pointer dereference on failed queue allocation

This commit guards ibmvfc_deregister_channel() against operating on unallocated
queues and exposes it for KUnit testing. It also adds a new KUnit test module
for the IBM POWER Virtual FC Client.

> diff --git a/drivers/scsi/ibmvscsi/ibmvfc-core.c b/drivers/scsi/ibmvscsi/ibmvfc-core.c
> index 145d559041f12..0fe6b6f4260ba 100644
> --- a/drivers/scsi/ibmvscsi/ibmvfc-core.c
> +++ b/drivers/scsi/ibmvscsi/ibmvfc-core.c

[ ... ]

> -static void ibmvfc_deregister_channel(struct ibmvfc_host *vhost,
> +/**
> + * ibmvfc_deregister_channel - Deregister a sub-CRQ channel with the hypervisor
> + * @vhost:	ibmvfc host struct
> + * @channels:	ibmvfc channels struct containing the sub-CRQ array
> + * @index:	index into the sub-CRQ array
> + *
> + * Frees the IRQ, disposes of the IRQ mapping, and calls H_FREE_SUB_CRQ to
> + * release the sub-CRQ with the hypervisor. On success the queue message
> + * buffer is zeroed and the current index is reset. If H_FREE_SUB_CRQ fails,
> + * an error is logged but the channel resources are cleaned up regardless.
> + */
> +VISIBLE_IF_KUNIT void ibmvfc_deregister_channel(struct ibmvfc_host *vhost,
>  				      struct ibmvfc_channels *channels,
>  				      int index)
>  {

[Severity: Low]
Does this cause a build failure when CONFIG_KUNIT is disabled?

Since <kunit/visibility.h> is only included conditionally in ibmvfc.h under
#if IS_ENABLED(CONFIG_KUNIT), won't the unconditional use of VISIBLE_IF_KUNIT
here (and EXPORT_SYMBOL_IF_KUNIT below) result in syntax errors during a
standard build without KUnit?

[ ... ]

> diff --git a/drivers/scsi/ibmvscsi/ibmvfc.h b/drivers/scsi/ibmvscsi/ibmvfc.h
> index ca80ceffe53a5..421ce8bc3ea33 100644
> --- a/drivers/scsi/ibmvscsi/ibmvfc.h
> +++ b/drivers/scsi/ibmvscsi/ibmvfc.h

[ ... ]

> +#if IS_ENABLED(CONFIG_KUNIT)
> +#include <kunit/visibility.h>
> +VISIBLE_IF_KUNIT void ibmvfc_deregister_channel(struct ibmvfc_host *vhost,
> +						struct ibmvfc_channels *channels,
> +						int index);
> +VISIBLE_IF_KUNIT struct ibmvfc_host *ibmvfc_get_first_vhost(void);
> +#endif

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015-ibmvfc-fpin-support-v14-0-a0b063b8d825@linux.ibm.com?part=3

  reply	other threads:[~2026-10-15 15:20 UTC|newest]

Thread overview: 31+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-10-15 15:06 [PATCH v14 00/11] scsi: ibmvfc: make ibmvfc support FPIN messages Dave Marquardt via B4 Relay
2026-10-15 15:06 ` Dave Marquardt
2026-10-15 15:07 ` [PATCH v14 01/11] scsi: ibmvfc: fix IRQ leak and guard deregister on channel reg failure Dave Marquardt via B4 Relay
2026-10-15 15:07   ` Dave Marquardt
2026-10-15 15:07 ` [PATCH v14 02/11] scsi: ibmvfc: fix potential clobbering of rc after failed irq setup Dave Marquardt via B4 Relay
2026-10-15 15:07   ` Dave Marquardt
2026-10-15 15:07 ` [PATCH v14 03/11] scsi: ibmvfc: fix potential NULL pointer dereference on failed queue allocation Dave Marquardt via B4 Relay
2026-10-15 15:07   ` Dave Marquardt
2026-10-15 15:20   ` sashiko-bot [this message]
2026-10-15 16:15     ` Dave Marquardt
2026-10-15 15:07 ` [PATCH v14 04/11] scsi: ibmvfc: add basic FPIN support Dave Marquardt via B4 Relay
2026-10-15 15:07   ` Dave Marquardt
2026-10-15 15:18   ` sashiko-bot
2026-10-15 21:47     ` Dave Marquardt
2026-10-15 15:07 ` [PATCH v14 05/11] scsi: ibmvfc: add NOOP command support Dave Marquardt via B4 Relay
2026-10-15 15:07   ` Dave Marquardt
2026-10-15 15:07 ` [PATCH v14 06/11] scsi: ibmvfc: add FPIN extended flag and async sub-CRQ queue handle Dave Marquardt via B4 Relay
2026-10-15 15:07   ` Dave Marquardt
2026-10-15 15:07 ` [PATCH v14 07/11] scsi: ibmvfc: extend async event handlers for async sub-CRQ events Dave Marquardt via B4 Relay
2026-10-15 15:07   ` Dave Marquardt
2026-10-15 15:20   ` sashiko-bot
2026-10-15 15:07 ` [PATCH v14 08/11] scsi: ibmvfc: add interrupt routine for asynchronous sub CRQ Dave Marquardt via B4 Relay
2026-10-15 15:07   ` Dave Marquardt
2026-10-15 15:07 ` [PATCH v14 09/11] scsi: ibmvfc: extend channel reg/dereg helpers for async sub-CRQ Dave Marquardt via B4 Relay
2026-10-15 15:07   ` Dave Marquardt
2026-10-15 15:21   ` sashiko-bot
2026-10-15 15:07 ` [PATCH v14 10/11] scsi: ibmvfc: register and use asynchronous sub CRQ for events Dave Marquardt via B4 Relay
2026-10-15 15:07   ` Dave Marquardt
2026-10-15 15:28   ` sashiko-bot
2026-10-15 15:07 ` [PATCH v14 11/11] scsi: ibmvfc: handle extended FPIN events Dave Marquardt via B4 Relay
2026-10-15 15:07   ` Dave Marquardt

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=sashiko-outbox-173054@kernel.org \
    --to=sashiko-bot@kernel.org \
    --cc=davemarq@linux.ibm.com \
    --cc=linux-scsi@vger.kernel.org \
    --cc=sashiko-reviews@lists.linux.dev \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.