Re: [PATCH v4 3/4] scsi: arcmsr: wrap the type B completion index before using it

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] scsi: arcmsr: Fixes trailer cites 1c57e86d75cf instead of
  1a4f550a09f8
--

commit bdb98590f8437552875503e5c3790a14bf604318
Author: Yehyeong Lee <yhlee@isslab.korea.ac.kr>

> scsi: arcmsr: wrap the type B completion index before using it
>
> struct MessageUnit_B lives in the dma_alloc_coherent() area shared with
> the adapter, and holds the completion ring next to the index into it:
>
>         uint32_t        done_qbuffer[ARCMSR_MAX_HBB_POSTQUEUE];
>         uint32_t        postq_index;
>         uint32_t        doneq_index;
>
> arcmsr_hbaB_postqueue_isr() takes doneq_index from there and subscripts
> done_qbuffer[] with it, and only afterwards reduces it:
>
>         index = reg->doneq_index;
>         while ((flag_ccb = reg->done_qbuffer[index]) != 0) {
>                 ...
>                 reg->done_qbuffer[index] = 0;
>                 index++;
>                 index %= ARCMSR_MAX_HBB_POSTQUEUE;
>                 reg->doneq_index = index;
>         }
>
> So the first iteration uses the value as it was found, unmasked.  An
> index beyond ARCMSR_MAX_HBB_POSTQUEUE (264) reads past done_qbuffer[]
> and, should the word it finds be non-zero, stores a zero there as well.
> arcmsr_hbaB_polling_ccbdone() has the same ordering.
>
> Reduce the index where it is read instead, which leaves the rest of the
> loop unchanged.
>
> Measured with a KASAN build.  struct MessageUnit_B is 2176 bytes with
> done_qbuffer at offset 1056, so a reported index of 600 reads 3456 bytes
> in:
>
>   BUG: KASAN: slab-out-of-bounds in arcmsr_hbaB_postqueue_isr+0x1f5/0x270 [arcmsr]
>   Read of size 4 at addr ffff88800c08cd80 by task init/1
>   ...
>    which belongs to the cache kmalloc-4k of size 4096
>   The buggy address is located 1280 bytes to the right of
>
> Fixes: 1c57e86d75cf ("[SCSI] arcmsr: initial driver, version 1.20.00.13")
> Cc: stable@vger.kernel.org
> Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>

[Severity: Low]
1c57e86d75cf ("[SCSI] arcmsr: initial driver, version 1.20.00.13") only
supported Type A adapters.  Type B adapter support, struct MessageUnit_B,
and the unmasked reg->doneq_index reads in arcmsr_hbaB_postqueue_isr() and
arcmsr_hbaB_polling_ccbdone() (originally named arcmsr_hbb_postqueue_isr()
and arcmsr_polling_hbb_ccbdone()) were introduced later.  Should the Fixes:
tag be:

  Fixes: 1a4f550a09f8 ("[SCSI] arcmsr: 1.20.00.15: add SATA RAID plus other fixes")

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261114033810.549787-1-yhlee@isslab.korea.ac.kr?part=3