Re: [PATCH v3 26/40] scsi: lpfc: use 16-bits defined sense codes

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] `lpfc_calc_bg_err` incorrectly mixes physical and DMA scatterlist concepts by using `sg_virt()` with `sg_dma_len()`, leading to out-of-bounds memory access if the IOMMU coalesces segments.
--

commit 2a7f5cef754d14cd9ca36fe2a3d4393a003f4af6
Author: Damien Le Moal <dlemoal@kernel.org>

scsi: lpfc: use 16-bits defined sense codes

Refactor the lpfc driver to use scsi_set_sense() and replace all
hard-coded additional sense codes and additional sense code qualifiers
with the enum values defined in include/scsi/scsi_sense.h.

> diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
> index 8a795c65e3c3e..849d4de91b381 100644
> --- a/drivers/scsi/lpfc/lpfc_scsi.c
> +++ b/drivers/scsi/lpfc/lpfc_scsi.c
> @@ -2848,7 +2848,8 @@ lpfc_calc_bg_err(struct lpfc_hba *phba, struct lpfc_io_buf *lpfc_cmd)
>  	}
>  out:
>  	if (err_type == BGS_GUARD_ERR_MASK) {
> -		scsi_build_sense(cmd, 1, ILLEGAL_REQUEST, 0x10, 0x1);
> +		scsi_set_sense(cmd, 1, ILLEGAL_REQUEST,
> +			       LOGICAL_BLOCK_GUARD_CHECK_FAILED);

[Severity: High]
This is a pre-existing issue, but while reviewing the changes in
lpfc_calc_bg_err(), I noticed that it might incorrectly mix physical and DMA
scatterlist concepts when a BlockGuard error occurs and lpfc_parse_bg_err()
falls back to this function.

If the system IOMMU coalesced multiple physical scatterlist segments into a
single DMA segment, can sg_dma_len() exceed the physical length?

The code earlier in lpfc_calc_bg_err() appears to use sg_dma_len() to iterate
over a CPU virtual address mapping:

drivers/scsi/lpfc/lpfc_scsi.c:lpfc_calc_bg_err() {
    ...
    data_src = (uint8_t *)sg_virt(sgde);
    data_len = sg_dma_len(sgde);
    ...
    src = (struct scsi_dif_tuple *)sg_virt(sgpe);
    start_ref_tag = scsi_prot_ref_tag(cmd);
    start_app_tag = src->app_tag;
    len = sg_dma_len(sgpe);
    ...
}

Does advancing a virtual pointer obtained from sg_virt() by sg_dma_len() read
past the end of the physically contiguous page into unrelated memory,
potentially causing an out-of-bounds memory read?

This could be triggered by storage hardware errors or corrupted IO on systems
with IOMMU enabled, leading to incorrect diagnostic checksums, false error
reports, or a kernel panic if it crosses into unmapped memory.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260904002644.157668-1-dlemoal@kernel.org?part=26