Re: [PATCH v4 56/56] scsi: qla2xxx: Update version to 12.00.00.2607b1

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:

New issues:
- [Medium] The new QLA_DRIVER_BETA_VER (2607) exceeds 8 bits, causing a bitwise overlap that corrupts the patch version byte in the firmware telemetry/minidump template header.
- [Medium] The sscanf format specifier %hhu truncates the new beta version (2607) during string parsing, leading to incorrect version logging.

Pre-existing issues:
- [High] Changing the length of `QLA2XXX_VERSION` to an odd number of bytes triggers an off-by-one parity bug in `qla82xx_set_driver_version()`, resulting in a global out-of-bounds read and info leak.
--

--- Patch [56]: [PATCH v4 56/56] scsi: qla2xxx: Update version to 12.00.00.2607b1 ---
commit 5dbc42f224e77d9a08367012fa8509d93dd148ac
Author: Nilesh Javali <njavali@marvell.com>

scsi: qla2xxx: Update version to 12.00.00.2607b1

This commit updates the QLogic FC HBA driver version strings and macros to
12.00.00.2607b1 and increments the major and beta version numbers.

> diff --git a/drivers/scsi/qla2xxx/qla_version.h b/drivers/scsi/qla2xxx/qla_version.h
> index 9564beafdab71..1c0b01d703509 100644
> --- a/drivers/scsi/qla2xxx/qla_version.h
> +++ b/drivers/scsi/qla2xxx/qla_version.h
> @@ -6,9 +6,9 @@
>  /*
>   * Driver version
>   */
> -#define QLA2XXX_VERSION      "10.02.10.100-k"
> +#define QLA2XXX_VERSION      "12.00.00.2607b1"

[Severity: High]
This is a pre-existing issue, but changing the version string length to an
odd number of bytes (15 bytes) triggers an out-of-bounds read during driver
initialization.

In drivers/scsi/qla2xxx/qla_mbx.c:qla82xx_set_driver_version(), the
parsing loop decrements the length by 2 on each iteration:

	for (i = 4; i < 16 && len; i++, str++, len -= 2) {

Because the new string length is odd, the len variable will drop from 1 to -1,
bypassing zero. Since -1 evaluates to true in C, will this cause the loop to 
read past the end of the string literal into adjacent memory until the loop
limit is hit?

> -#define QLA_DRIVER_MAJOR_VER	10
> -#define QLA_DRIVER_MINOR_VER	02
> -#define QLA_DRIVER_PATCH_VER	10
> -#define QLA_DRIVER_BETA_VER	100
> +#define QLA_DRIVER_MAJOR_VER	12
> +#define QLA_DRIVER_MINOR_VER	00
> +#define QLA_DRIVER_PATCH_VER	00
> +#define QLA_DRIVER_BETA_VER	2607

[Severity: Medium]
Will this new beta version (2607) corrupt the telemetry minidump header?

In drivers/scsi/qla2xxx/qla_nx.c:qla82xx_md_prep(), the version macros are
shifted and combined using bitwise OR:

	tmplt_hdr->driver_info[1] = (QLA_DRIVER_MAJOR_VER << 24) |
	    (QLA_DRIVER_MINOR_VER << 16) | (QLA_DRIVER_PATCH_VER << 8) |
	    QLA_DRIVER_BETA_VER;

Since 2607 (0xA2F) exceeds 8 bits, it appears it will bleed into the space
designated for the patch version, corrupting the reported driver info.

[Severity: Medium]
Does the firmware template logging also truncate this new beta value?

Looking at drivers/scsi/qla2xxx/qla_tmpl.c:qla27xx_driver_info(), the version
string is parsed using %hhu:

	WARN_ON_ONCE(sscanf(qla2x00_version_str,
			    "%hhu.%hhu.%hhu.%hhu",
			    v + 0, v + 1, v + 2, v + 3) != 4);

Since %hhu expects an 8-bit unsigned integer, parsing 2607 will silently
truncate the beta version modulo 256 (resulting in 47). Could this cause
diagnostic tools to misreport the version?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260714095353.289460-1-njavali@marvell.com?part=56