Re: [PATCH v4 26/56] scsi: qla2xxx: Update handling of status entries for 29xx series

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Integer underflow in `par_sense_len` calculation allows an out-of-bounds read of the response queue memory into the SCSI command's sense buffer.
--

--- Patch [26]: [PATCH v4 26/56] scsi: qla2xxx: Update handling of status entries for 29xx series ---
commit e2f9d1fbc9c40b5adf48f40bcf83f40782a2ac76
Author: Nilesh Javali <njavali@marvell.com>

scsi: qla2xxx: Update handling of status entries for 29xx series

This commit updates the handling of status entries in the qla2xxx driver
to support the 29xx series. It updates function signatures to accept generic
pointers for status packets and differentiates between standard and
extended status entries.

> diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
> --- a/drivers/scsi/qla2xxx/qla_isr.c
> +++ b/drivers/scsi/qla2xxx/qla_isr.c
[ ... ]
> @@ -3429,20 +3454,20 @@ qla2x00_status_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, void *pkt)
>  	sense_len = par_sense_len = rsp_info_len = resid_len =
>  	    fw_resid_len = 0;
>  	if (IS_FWI2_CAPABLE(ha)) {
> +		qla_sts_fwi2_extract(ha, pkt, &sf);
>  		if (scsi_status & SS_SENSE_LEN_VALID)
> -			sense_len = le32_to_cpu(sts24->sense_len);
> +			sense_len = sf.sense_len;
>  		if (scsi_status & SS_RESPONSE_INFO_LEN_VALID)
> -			rsp_info_len = le32_to_cpu(sts24->rsp_data_len);
> +			rsp_info_len = sf.rsp_data_len;
>  		if (scsi_status & (SS_RESIDUAL_UNDER | SS_RESIDUAL_OVER))
> -			resid_len = le32_to_cpu(sts24->rsp_residual_count);
> +			resid_len = sf.rsp_residual_count;
>  		if (comp_status == CS_DATA_UNDERRUN)
>  			fw_resid_len = le32_to_cpu(sts24->residual_len);
> -		rsp_info = sts24->data;
> -		sense_data = sts24->data;
> -		host_to_fcp_swap(sts24->data, sizeof(sts24->data));
> +		rsp_info = sf.data;
> +		sense_data = sf.data;
> +		par_sense_len = sf.data_sz;

[Severity: High]
This is a pre-existing issue, but could this par_sense_len calculation
lead to an integer underflow?

Further down in qla2x00_status_entry(), when checking for FCP transport
errors, the code adjusts these pointers:

    if (IS_FWI2_CAPABLE(ha)) {
        sense_data += rsp_info_len;
        par_sense_len -= rsp_info_len;
    }

If a maliciously large rsp_info_len is received in the FCP_RSP frame,
par_sense_len could underflow since there is no validation checking if
rsp_info_len exceeds par_sense_len.

Later in qla2x00_handle_sense(), this bounds check wouldn't protect against
the underflowed par_sense_len:

    if (sense_len > par_sense_len)
        sense_len = par_sense_len;

    memcpy(cp->sense_buffer, sense_data, sense_len);

Can this result in an out-of-bounds read of the response queue memory into
the SCSI command's sense buffer?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260714095353.289460-1-njavali@marvell.com?part=26