Re: [PATCH v6 56/56] scsi: qla2xxx: Update version to 12.00.00.2607b1

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] The new driver version string has an odd length, causing an infinite loop condition and out-of-bounds read in `qla82xx_set_driver_version`.
- [Medium] The new `QLA_DRIVER_BETA_VER` and `QLA2XXX_VERSION` values exceed the 8-bit limits assumed by the minidump and firmware dump metadata generators, leading to corrupted version reporting.
--

--- Patch [56]: [PATCH v6 56/56] scsi: qla2xxx: Update version to 12.00.00.2607b1 ---
commit 7e58cb94f7bd9df990cb9116b395dd17502493c0
Author: Nilesh Javali <njavali@marvell.com>

scsi: qla2xxx: Update version to 12.00.00.2607b1

This commit updates the QLA2XXX driver version string and the corresponding
major, minor, patch, and beta version macros.

> diff --git a/drivers/scsi/qla2xxx/qla_version.h b/drivers/scsi/qla2xxx/qla_version.h
> index 9564beafdab71..1c0b01d703509 100644
> --- a/drivers/scsi/qla2xxx/qla_version.h
> +++ b/drivers/scsi/qla2xxx/qla_version.h
> @@ -6,9 +6,9 @@
>  /*
>   * Driver version
>   */
> -#define QLA2XXX_VERSION      "10.02.10.100-k"
> +#define QLA2XXX_VERSION      "12.00.00.2607b1"

[Severity: High]
Does changing this version string to an odd length (15 bytes) cause a loop
overrun and out-of-bounds read in qla82xx_set_driver_version()?

Looking at drivers/scsi/qla2xxx/qla_mbx.c:qla82xx_set_driver_version():

	for (i = 4; i < 16 && len; i++, str++, len -= 2) {
		mcp->mb[i] = le16_to_cpup(str);
		mcp->out_mb |= 1<<i;
	}

Since len is initialized to the string length, an odd length causes len to step
from 1 to -1. The loop condition && len will remain true when it goes negative,
causing the loop to continue and read past the end of the string literal.

>  
> -#define QLA_DRIVER_MAJOR_VER	10
> -#define QLA_DRIVER_MINOR_VER	02
> -#define QLA_DRIVER_PATCH_VER	10
> -#define QLA_DRIVER_BETA_VER	100
> +#define QLA_DRIVER_MAJOR_VER	12
> +#define QLA_DRIVER_MINOR_VER	00
> +#define QLA_DRIVER_PATCH_VER	00
> +#define QLA_DRIVER_BETA_VER	2607

[Severity: Medium]
Does this new beta version value exceed 8-bit limits and corrupt the driver
version metadata in diagnostic dumps?

In drivers/scsi/qla2xxx/qla_nx.c:qla82xx_md_collect(), the version components
are packed into a 32-bit integer:

	tmplt_hdr->driver_info[1] = (QLA_DRIVER_MAJOR_VER << 24) |
	    (QLA_DRIVER_MINOR_VER << 16) | (QLA_DRIVER_PATCH_VER << 8) |
	    QLA_DRIVER_BETA_VER;

Since 2607 (0x0A2F) is larger than 8 bits, the bitwise OR will overflow and
overwrite the patch version byte.

Additionally, in drivers/scsi/qla2xxx/qla_tmpl.c:qla27xx_driver_info(), the
%hhu format specifier is used to parse the string version:

	WARN_ON_ONCE(sscanf(qla2x00_version_str,
			    "%hhu.%hhu.%hhu.%hhu",
			    v + 0, v + 1, v + 2, v + 3) != 4);

This will silently truncate the beta version 2607 to 47.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260723050413.3897522-1-njavali@marvell.com?part=56