Re: [PATCH v4] scsi: qla2xxx: Fix flex array member not at end

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing bounds check on user-provided BSG request length leads to out-of-bounds memory accesses when casting to driver-specific structures.
--

--- Patch [1]: [PATCH v4] scsi: qla2xxx: Fix flex array member not at end ---
commit 5047f2de85357d7b297d2d46b642495d4d1e88e7
Author: Jesse Taube <jtaubepe@redhat.com>

scsi: qla2xxx: Fix flex array member not at end

In qla_edif_bsg.h: struct fc_bsg_reply and struct fc_bsg_request have flexible
array members, thus they must be the last member of the parent structure. This
commit puts them inside a union with trailing members padded to silence warnings.

> diff --git a/drivers/scsi/qla2xxx/qla_edif_bsg.h b/drivers/scsi/qla2xxx/qla_edif_bsg.h
> index 514c265ba86e2..2b32a31856292 100644
> --- a/drivers/scsi/qla2xxx/qla_edif_bsg.h
> +++ b/drivers/scsi/qla2xxx/qla_edif_bsg.h
> @@ -36,16 +36,26 @@ struct extra_auth_els {
>  } __packed;
>  
>  struct qla_bsg_auth_els_request {
> -	struct fc_bsg_request r;
> -	struct extra_auth_els e;
> +	union {
> +		struct fc_bsg_request r;
> +		struct {
> +			unsigned char __fc_bsg_request_sz[sizeof(struct fc_bsg_request)];
> +			struct extra_auth_els e;
> +		};
> +	};
>  };

[Severity: High]
This is a pre-existing issue, but while reviewing this structure I noticed a
potential missing bounds check on the user-provided BSG request length.

When a local user with CAP_SYS_RAWIO issues an SG_IO ioctl on the BSG device
with a maliciously small request_len, the BSG core allocates exactly
request_len bytes using memdup_user().

Since the core fc_bsg_host_dispatch calculates the expected cmdlen but never
validates job->request_len against it, could this lead to an out-of-bounds
heap read when casting bsg_job->request to larger structures?

For instance, in drivers/scsi/qla2xxx/qla_bsg.c:qla2x00_process_vendor_specific(),
vendor_cmd[0] is accessed without checking if request_len is sufficiently large:

	ql_dbg(ql_dbg_edif, vha, 0x911b, "%s FC_BSG_HST_VENDOR cmd[0]=0x%x\n",
	    __func__, bsg_request->rqst_data.h_vendor.vendor_cmd[0]);

	switch (bsg_request->rqst_data.h_vendor.vendor_cmd[0]) {

Similarly, in drivers/scsi/qla2xxx/qla_edif.c:qla_bsg_check(), the code directly
dereferences req->e.sub_cmd assuming the request buffer is fully sized:

	if (p->sub_cmd == PULL_ELS) {

Is it possible to validate bsg_job->request_len before accessing these
driver-specific payload fields to prevent out-of-bounds accesses?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260727164842.2123122-1-jtaubepe@redhat.com?part=1