From: sashiko-bot@kernel.org
To: "Phil Pemberton" <philpem@philpem.me.uk>
Cc: linux-ide@vger.kernel.org, dlemoal@kernel.org, cassel@kernel.org,
linux-scsi@vger.kernel.org
Subject: Re: [PATCH v7 4/6] scsi: add BLIST_NO_LUN_1F blacklist flag
Date: Thu, 11 Jun 2026 02:59:23 +0000 [thread overview]
Message-ID: <20260611025923.A319C1F00893@smtp.kernel.org> (raw)
In-Reply-To: <20260611024356.2769320-5-philpem@philpem.me.uk>
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Unsynchronized read-modify-write of bitfields in `struct scsi_target` (`pdt_1f_for_no_lun`) causes a data race that can corrupt concurrent updates to `expecting_lun_change`.
--
commit 22aca9342fbe7619010508e9209d9f91ff554f8a
Author: Phil Pemberton <philpem@philpem.me.uk>
scsi: add BLIST_NO_LUN_1F blacklist flag
This commit adds a new blacklist flag, BLIST_NO_LUN_1F, to handle multi-LUN
devices that respond to INQUIRY on unpopulated LUNs with PQ=0 / PDT=0x1f. It
wires this flag up in scsi_probe_and_add_lun() to set the pdt_1f_for_no_lun
field on the scsi_target.
> diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
> index ef22a4228b855..ef0f5ee6be87d 100644
> --- a/drivers/scsi/scsi_scan.c
> +++ b/drivers/scsi/scsi_scan.c
> @@ -1285,6 +1285,9 @@ static int scsi_probe_and_add_lun(struct scsi_target *starget,
> * PDT=00h Direct-access device (floppy)
> * PDT=1Fh none (no FDD connected to the requested logical unit)
> */
> + if (bflags & BLIST_NO_LUN_1F)
> + starget->pdt_1f_for_no_lun = 1;
[Severity: High]
Does this unprotected bitfield assignment risk a data race?
In include/scsi/scsi_device.h, pdt_1f_for_no_lun shares a memory word with
expecting_lun_change in struct scsi_target.
If this function processes LUN 1 while LUN 0 has already been added and is
processing I/O, a concurrent UNIT_ATTENTION could trigger an update to
expecting_lun_change from softirq context in
drivers/scsi/scsi_error.c:scsi_report_lun_change():
sdev->sdev_target->expecting_lun_change = 1;
Since bitfield assignments are implemented as non-atomic read-modify-write
sequences by the compiler, could this process-context write to
pdt_1f_for_no_lun silently overwrite and drop the softirq's update to
expecting_lun_change?
> +
> if (((result[0] >> 5) == 1 || starget->pdt_1f_for_no_lun) &&
> (result[0] & 0x1f) == 0x1f &&
> !scsi_is_wlun(lun)) {
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260611024356.2769320-1-philpem@philpem.me.uk?part=4
parent reply other threads:[~2026-06-11 2:59 UTC|newest]
Thread overview: expand[flat|nested] mbox.gz Atom feed
[parent not found: <20260611024356.2769320-5-philpem@philpem.me.uk>]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260611025923.A319C1F00893@smtp.kernel.org \
--to=sashiko-bot@kernel.org \
--cc=cassel@kernel.org \
--cc=dlemoal@kernel.org \
--cc=linux-ide@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=philpem@philpem.me.uk \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox