Re: [PATCH] scsi: qla2xxx: Fix BSG request hang on flash image validation failure

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] Returning a negative error code to the BSG core truncates the reply payload, silently discarding vendor-specific diagnostic codes and breaking userspace API expectations.
--

commit 4f9a7c7b8cae4329ddb272256609d33b20e03bb0
Author: Guangshuo Li <lgs201920130244@gmail.com>

scsi: qla2xxx: Fix BSG request hang on flash image validation failure

This patch aims to fix a hang when flash image validation fails. It modifies
qla28xx_validate_flash_image() to return an error code instead of QLA_SUCCESS
when validation fails. This prevents the BSG request from remaining in-flight
until it times out.

> diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c
> index 5e910b5ca670d..5b2201859f730 100644
> --- a/drivers/scsi/qla2xxx/qla_bsg.c
> +++ b/drivers/scsi/qla2xxx/qla_bsg.c
> @@ -3369,5 +3369,5 @@ static int qla28xx_validate_flash_image(struct bsg_job *bsg_job)
>  		bsg_job_done(bsg_job, bsg_reply->result,
>  			     bsg_reply->reply_payload_rcv_len);
>  
> -	return QLA_SUCCESS;
> +	return rval;

[Severity: Critical]
Does returning a negative error code here truncate the reply payload and
discard the vendor-specific diagnostic codes?

Earlier in qla28xx_validate_flash_image(), the code carefully constructs
an extended vendor status payload:

    if (rval)
        bsg_reply->reply_data.vendor_reply.vendor_rsp[0] =
            (state == 39) ? EXT_STATUS_IMG_SET_VALID_ERR :
            EXT_STATUS_IMG_SET_CONFIG_ERR;

However, when this function returns a negative error code instead of
QLA_SUCCESS, the BSG core intercepts it as a transport failure.

This occurs in the transport layer:

drivers/scsi/scsi_transport_fc.c:fc_bsg_host_dispatch() {
    ...
    if (ret) {
        /* transport error */
        job->reply_len = sizeof(uint32_t);
        ...
    }
    ...
}

Will this force the reply length to 4 bytes and silently drop the
reply_data payload, breaking userspace API expectations for these
validation errors?

>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260704174603.255881-1-lgs201920130244@gmail.com?part=1