Re: [PATCH v4 03/56] scsi: qla2xxx: Add NVRAM config support for 29xx adapters

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Missing assignment `ha->fiv = NULL` when `qla29xx_read_optrom_data` fails to read the Flash Image Version (FMB).
--

--- Patch [3]: [PATCH v4 03/56] scsi: qla2xxx: Add NVRAM config support for 29xx adapters ---
commit 9423305e2fdeec148901334c684199e074dc7d5b
Author: Manish Rangankar <mrangankar@marvell.com>

scsi: qla2xxx: Add NVRAM config support for 29xx adapters

Extend the NVRAM read and configuration-apply paths to handle the
29xx series.  The 29xx NVRAM layout is similar to the 81xx family,
so reuse the existing nvram_81xx parsing while adding
29xx-specific fields and init-sequence integration.

> diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
> index e23e7ac48ae26..f5d230fc3642d 100644
> --- a/drivers/scsi/qla2xxx/qla_init.c
> +++ b/drivers/scsi/qla2xxx/qla_init.c

[ ... ]

> @@ -9306,34 +9306,97 @@ qla81xx_nvram_config(scsi_qla_host_t *vha)

[ ... ]

> +		ha->fiv = (struct qla_flash_memo_block *)
> +			((char *)ha->vpd + ha->vpd_size);
> +
> +		buf = qla29xx_read_optrom_data(vha, FLT_REG_FMB_PRI,
> +					       fw_options, ha->fiv, 0,
> +					       sizeof(struct qla_flash_memo_block));
> +		if (!buf) {
> +			ql_log(ql_log_info, vha, 0x01be,
> +			    "Unable to read Flash Image Version.\n");

[Severity: Medium]
Does this code leave ha->fiv pointing to an uninitialized buffer if the
qla29xx_read_optrom_data() read fails?

In the invalid signature check immediately below, ha->fiv is explicitly set
to NULL. If ha->fiv isn't also set to NULL here on a read failure, any future
code checking if ha->fiv is populated might falsely assume the FMB data is
available and attempt to operate on the uninitialized buffer.

> +		} else if (ha->fiv->signature != QLFC_FMB_SIG) {
> +			ql_log(ql_log_warn, vha, 0x01bf,
> +			    "Invalid FMB signature %#x, expected %#x.\n",
> +			    le32_to_cpu(ha->fiv->signature),
> +			    le32_to_cpu(QLFC_FMB_SIG));
> +			ha->fiv = NULL;
> +		} else {

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260714095353.289460-1-njavali@marvell.com?part=3