Re: [PATCH v4 49/56] scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] qla84xx_verify_chip misses checking entry_status after issuing VERIFY_CHIP_IOCB_TYPE command, mirroring the bug patched in qla24xx_modify_vp_config.
--

--- Patch [49]: [PATCH v4 49/56] scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config() ---
commit 3b96c82a05342dd19f7fa76f7754bb1b19a11803
Author: Nilesh Javali <njavali@marvell.com>
Subject: scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config()

This commit addresses a completion handling bug in the Modify VP Config
handler where the driver incorrectly treated early firmware IOCB
rejections as success by checking only comp_status. Adding a check for
entry_status fixes the bug by properly detecting early rejections.

> diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
> index b32ca8ed274d6..59023492c5a98 100644
> --- a/drivers/scsi/qla2xxx/qla_mbx.c
> +++ b/drivers/scsi/qla2xxx/qla_mbx.c
> @@ -4401,10 +4401,10 @@ qla24xx_modify_vp_config(scsi_qla_host_t *vha)
>  	if (rval != QLA_SUCCESS) {
>  		ql_dbg(ql_dbg_mbx, vha, 0x10bd,
>  		    "Failed to issue VP config IOCB (%x).\n", rval);
> -	} else if (vpmod->comp_status != 0) {
> +	} else if (vpmod->entry_status != 0) {
>  		ql_dbg(ql_dbg_mbx, vha, 0x10be,
>  		    "Failed to complete IOCB -- error status (%x).\n",
> -		    vpmod->comp_status);
> +		    vpmod->entry_status);
>  		rval = QLA_FUNCTION_FAILED;
>  	} else if (vpmod->comp_status != cpu_to_le16(CS_COMPLETE)) {
>  		ql_dbg(ql_dbg_mbx, vha, 0x10bf,

[Severity: High]
This isn't a bug introduced by this patch, but does the same missing
entry_status check issue exist in qla84xx_verify_chip() in the same file?

Looking at drivers/scsi/qla2xxx/qla_mbx.c:qla84xx_verify_chip(), the
IOCB buffer is zeroed out before being issued:

    memset(mn, 0, sizeof(*mn));
    mn->p.req.entry_type = VERIFY_CHIP_IOCB_TYPE;
    ...
    rval = qla2x00_issue_iocb_timeout(vha, mn, mn_dma, 0, 120);

After the command completes, the function directly checks comp_status:

    status[0] = le16_to_cpu(mn->p.rsp.comp_status);
    status[1] = status[0] == CS_VCS_CHIP_FAILURE ?
        le16_to_cpu(mn->p.rsp.failure_code) : 0;
    ...
    if (status[0] != CS_COMPLETE) {
        rval = QLA_FUNCTION_FAILED;

If the firmware rejects the IOCB early, would it set entry_status and
leave comp_status at 0 (which matches CS_COMPLETE)? This would cause
the driver to incorrectly assume the verify succeeded, similarly to the
issue fixed here.

Could this potentially leave the ISP8432 chip initialization in a broken
state with an internal firmware version of 0, leading to subsequent timeouts
or adapter lockups?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260714095353.289460-1-njavali@marvell.com?part=49