Re: [PATCH v5 35/56] scsi: qla2xxx: Update VP control IOCB handling for 29xx series

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The VP control IOCB builder `qla25xx_ctrlvp_iocb()` lacks a bounds check when calculating the index for `vce->vp_idx_map`, allowing an out-of-bounds array write if `vp_index` is large (> 128), which corrupts adjacent IOCB payload fields.
--

--- Patch [35]: [PATCH v5 35/56] scsi: qla2xxx: Update VP control IOCB handling for 29xx series ---
commit 38b9d8323d247867ce71b530d5556e360732b075
Author: Nilesh Javali <njavali@marvell.com>

scsi: qla2xxx: Update VP control IOCB handling for 29xx series

This updates VP control IOCB command and response handling to support the
29xx series adapters. It modifies helper functions to accept generic void
pointers so they can handle both standard and extended VP control entry
layouts interchangeably.

> diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
> --- a/drivers/scsi/qla2xxx/qla_iocb.c
> +++ b/drivers/scsi/qla2xxx/qla_iocb.c

[ ... ]

> @@ -4074,22 +4074,31 @@ qla_nvme_ls(srb_t *sp, struct pt_ls4_request *cmd_pkt)
>  }
>  
>  static void
> -qla25xx_ctrlvp_iocb(srb_t *sp, struct vp_ctrl_entry_24xx *vce)
> +qla25xx_ctrlvp_iocb(srb_t *sp, void *pkt)
>  {
> +	/*
> +	 * vp_ctrl_entry_24xx_ext is layout-identical to vp_ctrl_entry_24xx
> +	 * for all fields touched here (entry_type, handle, entry_count,

[ ... ]

>  	/*
>  	 * index map in firmware starts with 1; decrement index
>  	 * this is ok as we never use index 0
>  	 */
>  	map = (sp->u.iocb_cmd.u.ctrlvp.vp_index - 1) / 8;
>  	pos = (sp->u.iocb_cmd.u.ctrlvp.vp_index - 1) & 7;
> +
> +	vce->entry_type = VP_CTRL_IOCB_TYPE;
> +	vce->handle = sp->handle;
> +	vce->entry_count = 1;
> +	vce->command = cpu_to_le16(sp->u.iocb_cmd.u.ctrlvp.cmd);
> +	vce->vp_count = cpu_to_le16(1);
>  	vce->vp_idx_map[map] |= 1 << pos;

[Severity: High]
This is a pre-existing issue, but does this code overflow the vp_idx_map
array if vp_index exceeds 128?

Looking at the struct definition for vp_ctrl_entry_24xx in qla_fw.h, 
vp_idx_map is a 16-byte array. If the firmware advertises support for more
than 128 NPIV vports, the calculated map index in qla25xx_ctrlvp_iocb() could
be up to 31.

Could this out-of-bounds write corrupt the subsequent fields in the 
vp_ctrl_entry_24xx payload (like flags, id, and hopct) when an administrator
configures a large number of vports?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260717152904.3155730-1-njavali@marvell.com?part=35