Re: [PATCH v3 25/40] scsi: ps3rom: use 16-bits defined sense codes

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but in `ps3rom_interrupt`, the `cmd` pointer (retrieved from `priv->curr_cmd`) is dereferenced without a NULL check when processing mismatched tags or spurious async events.
--

commit 0fd451167d5347bf13c34e7718d8d4873fdfa19c
Author: Damien Le Moal <dlemoal@kernel.org>

scsi: ps3rom: use 16-bits defined sense codes

Refactor the PS3 DVD driver to use scsi_set_sense() and replace all
hard-coded additional sense codes and additional sense code qualifiers
with the enum values defined in include/scsi/scsi_sense.h.

> diff --git a/drivers/scsi/ps3rom.c b/drivers/scsi/ps3rom.c
> index a9c727d229313..c63c581b493c3 100644
> --- a/drivers/scsi/ps3rom.c
> +++ b/drivers/scsi/ps3rom.c

[ ... ]

> @@ -316,7 +317,7 @@ static irqreturn_t ps3rom_interrupt(int irq, void *data)
>  		goto done;
>  	}
>  
> -	scsi_build_sense(cmd, 0, sense_key, asc, ascq);
> +	scsi_set_sense(cmd, 0, sense_key, scsi_sense_code(asc, ascq));
>  
>  done:
>  	priv->curr_cmd = NULL;

[Severity: High]
This isn't a bug introduced by this patch, but while reviewing
ps3rom_interrupt(), it looks like there might be a pre-existing NULL pointer
dereference issue when a tag mismatch occurs.

If the hypervisor returns an asynchronous status with an unmatched tag
(tag != dev->tag) while the driver is idle, the code logs the mismatch:

	if (tag != dev->tag)
		dev_err(&dev->sbd.core,
			"%s:%u: tag mismatch, got %llx, expected %llx\n",
			__func__, __LINE__, tag, dev->tag);

But there is no early return on this path. The code continues on, retrieves
the command pointer (which would be NULL if the driver is idle):

	cmd = priv->curr_cmd;

And then unconditionally dereferences it:

	if (!status) {
		/* OK, completed */
		if (cmd->sc_data_direction == DMA_FROM_DEVICE) {

Could this lead to a kernel panic if a spurious async event or mismatched tag
is received while no command is active?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260904002644.157668-1-dlemoal@kernel.org?part=25