Re: [PATCH v3 88/88] scsi: qla2xxx: Update version to 12.00.00.2607b1

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] The odd-length version string causes an infinite loop condition evaluation, resulting in an out-of-bounds memory read into firmware mailbox registers.
- [Medium] The new QLA_DRIVER_BETA_VER (2607) exceeds 8 bits, causing data corruption and truncation in minidump headers.
--

--- Patch [88]: [PATCH v3 88/88] scsi: qla2xxx: Update version to 12.00.00.2607b1 ---
commit 7835c1af22d4a49f4cede46a4b0344d098aa7b95
Author: Nilesh Javali <njavali@marvell.com>

scsi: qla2xxx: Update version to 12.00.00.2607b1

This commit updates the driver version, major, minor, patch, and beta
version macros to reflect the new 12.00.00.2607b1 release.

> diff --git a/drivers/scsi/qla2xxx/qla_version.h b/drivers/scsi/qla2xxx/qla_version.h
> index 9564beafdab71..1c0b01d703509 100644
> --- a/drivers/scsi/qla2xxx/qla_version.h
> +++ b/drivers/scsi/qla2xxx/qla_version.h
> @@ -6,9 +6,9 @@
>  /*
>   * Driver version
>   */
> -#define QLA2XXX_VERSION      "10.02.10.100-k"
> +#define QLA2XXX_VERSION      "12.00.00.2607b1"

[Severity: High]
Does changing the version string length to an odd number (15 characters)
cause an out-of-bounds read?

In drivers/scsi/qla2xxx/qla_mbx.c:qla82xx_set_driver_version(), the loop
decrements the length by 2 on each iteration:

        for (i = 4; i < 16 && len; i++, str++, len -= 2) {
                mcp->mb[i] = le16_to_cpup(str);
                mcp->out_mb |= 1<<i;
        }

Since len starts as an odd number, len -= 2 will skip 0 and evaluate to
true for subsequent checks, causing the loop to continue reading past the
end of the string into adjacent memory until i reaches 16.

>  
> -#define QLA_DRIVER_MAJOR_VER	10
> -#define QLA_DRIVER_MINOR_VER	02
> -#define QLA_DRIVER_PATCH_VER	10
> -#define QLA_DRIVER_BETA_VER	100
> +#define QLA_DRIVER_MAJOR_VER	12
> +#define QLA_DRIVER_MINOR_VER	00
> +#define QLA_DRIVER_PATCH_VER	00
> +#define QLA_DRIVER_BETA_VER	2607

[Severity: Medium]
Will this new beta version exceed 8-bit packing constraints and corrupt the
version data?

The value 2607 requires 12 bits, but it is used in contexts expecting an
8-bit value. For example, in drivers/scsi/qla2xxx/qla_nx.c:qla82xx_md_collect(),
it spills into the patch version byte due to an unmasked bitwise OR:

        tmplt_hdr->driver_info[1] = (QLA_DRIVER_MAJOR_VER << 24) |
            (QLA_DRIVER_MINOR_VER << 16) | (QLA_DRIVER_PATCH_VER << 8) |
            QLA_DRIVER_BETA_VER;

Additionally, in drivers/scsi/qla2xxx/qla_tmpl.c:qla27xx_driver_info(), it
is parsed using the %hhu format string which silently truncates 2607 to 47:

        WARN_ON_ONCE(sscanf(qla2x00_version_str,
                            "%hhu.%hhu.%hhu.%hhu",
                            v + 0, v + 1, v + 2, v + 3) != 4);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260707055435.2680300-1-njavali@marvell.com?part=88