Re: [PATCH v6 16/56] scsi: qla2xxx: Enable get_adapter_id mailbox for 29xx

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Userspace access to Buffer-to-Buffer Credit (BBCR) data on QLA29XX adapters is blocked by a missing whitelist check in qla27xx_get_bbcr_data().
--

--- Patch [16]: [PATCH v6 16/56] scsi: qla2xxx: Enable get_adapter_id mailbox for 29xx ---
commit 9877d8e47534a68c96e077863320b75953d374f1
Author: Nilesh Javali <njavali@marvell.com>

scsi: qla2xxx: Enable get_adapter_id mailbox for 29xx
    
Add IS_QLA29XX() alongside the existing 27xx/28xx checks in
qla2x00_get_adapter_id() so that the additional mailbox
registers (buffer-to-buffer credit, SCM/EDC status) are read
on 29xx adapters.

> diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
> index 52d70b61654c7..3fc08120fdf11 100644
> --- a/drivers/scsi/qla2xxx/qla_mbx.c
> +++ b/drivers/scsi/qla2xxx/qla_mbx.c
[ ... ]
> @@ -1827,7 +1827,7 @@ qla2x00_get_adapter_id(scsi_qla_host_t *vha, uint16_t *id, uint8_t *al_pa,
>  			}
>  		}
>  
> -		if (IS_QLA27XX(vha->hw) || IS_QLA28XX(vha->hw)) {
> +		if (IS_QLA27XX(vha->hw) || IS_QLA28XX(vha->hw) || IS_QLA29XX(vha->hw)) {
>  			vha->bbcr = mcp->mb[15];

[Severity: Medium]
Will userspace be able to access the BBCR data read here for 29xx adapters?

Looking at qla27xx_get_bbcr_data() in drivers/scsi/qla2xxx/qla_bsg.c, the
BSG ioctl handler explicitly rejects adapters that are not 27xx or 28xx:

	if (!IS_QLA27XX(ha) && !IS_QLA28XX(ha))
		return -EPERM;

Should IS_QLA29XX(ha) be added to this check as well, so that the newly
read BBCR data isn't blocked from being retrieved by userspace querying
QL_VND_GET_BBCR_DATA?

>  			if (mcp->mb[7] & SCM_EDC_ACC_RECEIVED) {
>  				ql_log(ql_log_info, vha, 0x11a4,

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260723050413.3897522-1-njavali@marvell.com?part=16