Re: [PATCH v3 4/8] ibmvfc: define asynchronous sub-queue

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but the driver reads `setup->num_scsi_subq_channels` directly from a hypervisor-modified DMA buffer without validating it against the allocated size of the internal queue array, leading to a potential heap buffer overflow.
--

commit caceab058540895b7bcd0e5a48d2dfd281f362ec
Author: Dave Marquardt <davemarq@linux.ibm.com>

ibmvfc: define asynchronous sub-queue

Defines the asynchronous sub-queue structure, modifies the existing
channel setup structure, adds the asynchronous sub-queue to the
channels structure, and adds flags needed to tell VIOS to use the
sub-queue.

> diff --git a/drivers/scsi/ibmvscsi/ibmvfc.h b/drivers/scsi/ibmvscsi/ibmvfc.h
> index adfd67e85af86..f38dfae9924ca 100644
> --- a/drivers/scsi/ibmvscsi/ibmvfc.h
> +++ b/drivers/scsi/ibmvscsi/ibmvfc.h
[ ... ]
> @@ -579,6 +581,7 @@ struct ibmvfc_channel_setup {
>  	struct srp_direct_buf buffer;
>  	__be64 reserved2[5];
>  	__be64 channel_handles[IBMVFC_MAX_CHANNELS];
> +	__be64 async_subq_handle;

[Severity: High]
This isn't a bug introduced by this patch, but since the driver reads
setup->num_scsi_subq_channels directly from a hypervisor-modified DMA buffer,
could this lead to a potential heap buffer overflow?

Looking at drivers/scsi/ibmvscsi/ibmvfc.c:ibmvfc_channel_setup_done():

	active_queues = be32_to_cpu(setup->num_scsi_subq_channels);
	scrqs->active_queues = active_queues;
	...
		for (i = 0; i < active_queues; i++)
			scrqs->scrqs[i].vios_cookie =
				be64_to_cpu(setup->channel_handles[i]);

If the VIOS partition responds with an unexpectedly large value for
setup->num_scsi_subq_channels, would the driver write out of bounds into the
queue array without validating against the allocated size?

>  } __packed __aligned(8);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260702-ibmvfc-fpin-support-v3-0-d95b9547cf88@linux.ibm.com?part=4