[PATCH] scsi: qla2xxx: Fix BSG request hang on flash image validation failure

[PATCH] scsi: qla2xxx: Fix BSG request hang on flash image validation failure

[Guangshuo Li]

qla28xx_validate_flash_image() validates a flash image and reports the
result through the BSG reply. It only calls bsg_job_done() when the
validation succeeds.

However, the function always returns QLA_SUCCESS. If validation fails,
bsg_job_done() is skipped but the zero return value tells the BSG core
that the request was accepted and will be completed asynchronously. No
one completes the request afterwards, so the BSG request remains
in-flight until it times out.

Return the validation error when bsg_job_done() is not called. This lets
the BSG core complete the request with an error instead of waiting for a
completion that will never happen.

Fixes: c2c68225b145 ("scsi: qla2xxx: Fix bsg_done() causing double free")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/scsi/qla2xxx/qla_bsg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c
index 5e910b5ca670..5b2201859f73 100644
--- a/drivers/scsi/qla2xxx/qla_bsg.c
+++ b/drivers/scsi/qla2xxx/qla_bsg.c
@@ -3369,5 +3369,5 @@ static int qla28xx_validate_flash_image(struct bsg_job *bsg_job)
 		bsg_job_done(bsg_job, bsg_reply->result,
 			     bsg_reply->reply_payload_rcv_len);
 
-	return QLA_SUCCESS;
+	return rval;
 }
-- 
2.43.0

Re: [PATCH] scsi: qla2xxx: Fix BSG request hang on flash image validation failure

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] Returning a negative error code to the BSG core truncates the reply payload, silently discarding vendor-specific diagnostic codes and breaking userspace API expectations.
--

commit 4f9a7c7b8cae4329ddb272256609d33b20e03bb0
Author: Guangshuo Li <lgs201920130244@gmail.com>

scsi: qla2xxx: Fix BSG request hang on flash image validation failure

This patch aims to fix a hang when flash image validation fails. It modifies
qla28xx_validate_flash_image() to return an error code instead of QLA_SUCCESS
when validation fails. This prevents the BSG request from remaining in-flight
until it times out.

> diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c
> index 5e910b5ca670d..5b2201859f730 100644
> --- a/drivers/scsi/qla2xxx/qla_bsg.c
> +++ b/drivers/scsi/qla2xxx/qla_bsg.c
> @@ -3369,5 +3369,5 @@ static int qla28xx_validate_flash_image(struct bsg_job *bsg_job)
>  		bsg_job_done(bsg_job, bsg_reply->result,
>  			     bsg_reply->reply_payload_rcv_len);
>  
> -	return QLA_SUCCESS;
> +	return rval;

[Severity: Critical]
Does returning a negative error code here truncate the reply payload and
discard the vendor-specific diagnostic codes?

Earlier in qla28xx_validate_flash_image(), the code carefully constructs
an extended vendor status payload:

    if (rval)
        bsg_reply->reply_data.vendor_reply.vendor_rsp[0] =
            (state == 39) ? EXT_STATUS_IMG_SET_VALID_ERR :
            EXT_STATUS_IMG_SET_CONFIG_ERR;

However, when this function returns a negative error code instead of
QLA_SUCCESS, the BSG core intercepts it as a transport failure.

This occurs in the transport layer:

drivers/scsi/scsi_transport_fc.c:fc_bsg_host_dispatch() {
    ...
    if (ret) {
        /* transport error */
        job->reply_len = sizeof(uint32_t);
        ...
    }
    ...
}

Will this force the reply length to 4 bytes and silently drop the
reply_data payload, breaking userspace API expectations for these
validation errors?

>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260704174603.255881-1-lgs201920130244@gmail.com?part=1