Re: [PATCH v5] zfcp: Fix integer underflow in status read buffer payload length

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] zfcp: Build failure due to missing 'level' argument in zfcp_dbf_pl_write() call
--

commit cd0f8c110960ca9697ab6d9c8ecf78b8b828c640
Author: Ajaykumar Rajappa <ajaykr@linux.ibm.com>

zfcp: Fix integer underflow in status read buffer payload length

This commit fixes an integer underflow in status read buffer length
calculations by validating the payload access against the payload offset.
It prevents payload reads when the buffer length does not reach the payload
area, while maintaining existing tracing formatting.

> diff --git a/drivers/s390/scsi/zfcp_dbf.c b/drivers/s390/scsi/zfcp_dbf.c
> index 81fb8af408e9c..c5501eae99772 100644
> --- a/drivers/s390/scsi/zfcp_dbf.c
> +++ b/drivers/s390/scsi/zfcp_dbf.c

[ ... ]

> @@ -253,13 +254,17 @@ void zfcp_dbf_hba_fsf_uss(char *tag, struct zfcp_fsf_req *req)
>  	rec->u.uss.s_id = ntoh24(srb->s_id);
>  	memcpy(&rec->u.uss.res4, &srb->res4, sizeof(rec->u.uss.res4));
>  
> -	/* status read buffer payload length */
> -	rec->pl_len = (!srb->length) ? 0 : srb->length -
> -			offsetof(struct fsf_status_read_buffer, payload);
> +	/* Unconditionally store value-shifted SRB length: pl_len is a bijective
> +	 * map of srb->length (pl_len + pay_offset == srb->length). A bogus
> +	 * srb->length < pay_offset wraps to a large non-zero pl_len, which is
> +	 * unambiguously distinguishable from pl_len == 0(genuine empty payload)
> +	 */
> +	rec->pl_len = (u16)(srb->length - pay_offset);
>  
> -	if (rec->pl_len)
> +	/* Only access payload bytes when srb->length actually covers them. */
> +	if (srb->length > pay_offset)
>  		zfcp_dbf_pl_write(dbf, srb->payload.data, rec->pl_len,
> -				  "fsf_uss", req->req_id, ZFCP_DBF_PAY_LEVEL);
> +				  "fsf_uss", req->req_id);

[Severity: Low]
Does this change break the build? The function zfcp_dbf_pl_write() is 
defined as requiring 6 arguments:

static inline
void zfcp_dbf_pl_write(struct zfcp_dbf *dbf, void *data, u16 length,
                       char *area, u64 req_id, int level)

However, the modified call above drops the 6th argument 
(ZFCP_DBF_PAY_LEVEL), which will result in a 'too few arguments to function' 
compilation error.

>  log:
>  	debug_event(dbf->hba, level, rec, sizeof(*rec));
>  	spin_unlock_irqrestore(&dbf->hba_lock, flags);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261008095757.1813357-1-ajaykr@linux.ibm.com?part=1