Re: [PATCH v2 15/60] scsi: qla2xxx: Skip unsupported sysfs attributes for 29xx

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-after-free of `ha->cs84xx` due to premature release in `qla2x00_remove_one`.
--

commit ace8a251663829b774dad26691a4ec0924aeadf0
Author: Nilesh Javali <njavali@marvell.com>

scsi: qla2xxx: Skip unsupported sysfs attributes for 29xx

This commit updates several sysfs attribute show functions to return
-EPERM for the QLA29xx adapter. This prevents userspace tools from
seeing stale or undefined values for attributes that are meaningless
on this hardware.

> diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
> index 800751ab562a1..e8755ab86b6ac 100644
> --- a/drivers/scsi/qla2xxx/qla_attr.c
> +++ b/drivers/scsi/qla2xxx/qla_attr.c
> @@ -1499,6 +1502,9 @@ qla24xx_84xx_fw_version_show(struct device *dev,
>  	scsi_qla_host_t *vha = shost_priv(class_to_shost(dev));
>  	struct qla_hw_data *ha = vha->hw;
>  
> +	if (IS_QLA29XX(ha))
> +		return -EPERM;
> +
>  	if (!IS_QLA84XX(ha))
>  		return scnprintf(buf, PAGE_SIZE, "\n");
>  
>  	if (!ha->cs84xx->op_fw_version) {

[Severity: High]
This isn't a bug introduced by this patch, but can this lead to a
use-after-free during driver teardown?

During driver teardown, qla2x00_remove_one() appears to drop the reference
to cs84xx and free it before the sysfs attributes are unregistered:

drivers/scsi/qla2xxx/qla_os.c:qla2x00_remove_one() {
    ...
    qla84xx_put_chip(base_vha);
    ...
    scsi_remove_host(base_vha->host);
    ...
}

If a user concurrently reads the 84xx_fw_version sysfs file during this window,
it executes qla24xx_84xx_fw_version_show() which unconditionally dereferences
the now-freed ha->cs84xx pointer:

drivers/scsi/qla2xxx/qla_attr.c:qla24xx_84xx_fw_version_show() {
    ...
    if (!ha->cs84xx->op_fw_version) {
    ...
}

Does this window between dropping the reference to ha->cs84xx and unregistering
the host sysfs attributes allow for a use-after-free?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260612095333.1666592-1-njavali@marvell.com?part=15