[PATCH] scsi: smartpqi: Handle pqi_alloc_io_request() failure

[PATCH] scsi: smartpqi: Handle pqi_alloc_io_request() failure

[Triet Hoang]

Check the return value of pqi_alloc_io_request() before dereferencing
the returned request in pqi_submit_raid_request_synchronous() and
pqi_lun_reset().

Return SCSI_MLQUEUE_HOST_BUSY when a request cannot be allocated so that
the operation can be retried instead of dereferencing a NULL pointer.

Signed-off-by: Triet Hoang <triet.hoang.dev@gmail.com>
---
 drivers/scsi/smartpqi/smartpqi_init.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
index 5ec583dc2e7d..0930decef404 100644
--- a/drivers/scsi/smartpqi/smartpqi_init.c
+++ b/drivers/scsi/smartpqi/smartpqi_init.c
@@ -4667,6 +4667,10 @@ static int pqi_submit_raid_request_synchronous(struct pqi_ctrl_info *ctrl_info,
 	}
 
 	io_request = pqi_alloc_io_request(ctrl_info, NULL);
+	if (!io_request) {
+		rc = SCSI_MLQUEUE_HOST_BUSY;
+		goto out;
+	}
 
 	put_unaligned_le16(io_request->index,
 		&(((struct pqi_raid_path_request *)request)->request_id));
@@ -6353,6 +6357,9 @@ static int pqi_lun_reset(struct pqi_ctrl_info *ctrl_info, struct pqi_scsi_dev *d
 	struct pqi_task_management_request *request;
 
 	io_request = pqi_alloc_io_request(ctrl_info, NULL);
+	if (!io_request)
+		return SCSI_MLQUEUE_HOST_BUSY;
+
 	io_request->io_complete_callback = pqi_lun_reset_complete;
 	io_request->context = &wait;
 
-- 
2.53.0

Re: [PATCH] scsi: smartpqi: Handle pqi_alloc_io_request() failure

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The patch adds unreachable NULL pointer checks for `pqi_alloc_io_request()`. Furthermore, if the code were ever reached, it incorrectly returns a SCSI midlayer queuecommand status code (`SCSI_MLQUEUE_HOST_BUSY`) from synchronous internal management functions.
--

--- Patch [1]: [PATCH] scsi: smartpqi: Handle pqi_alloc_io_request() failure ---
commit 1b3d9355dc4c0807df6a24f973784ecb04a972d7
Author: Triet Hoang <triet.hoang.dev@gmail.com>

scsi: smartpqi: Handle pqi_alloc_io_request() failure

Check the return value of pqi_alloc_io_request() before dereferencing
the returned request in pqi_submit_raid_request_synchronous() and
pqi_lun_reset(). Returns SCSI_MLQUEUE_HOST_BUSY when allocation fails.

> diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
> index 140e8a6addbe3..5c4f9481923a7 100644
> --- a/drivers/scsi/smartpqi/smartpqi_init.c
> +++ b/drivers/scsi/smartpqi/smartpqi_init.c
> @@ -4673,6 +4673,10 @@ static int pqi_submit_raid_request_synchronous(struct pqi_ctrl_info *ctrl_info,
>  	}
>  
>  	io_request = pqi_alloc_io_request(ctrl_info, NULL);
> +	if (!io_request) {
> +		rc = SCSI_MLQUEUE_HOST_BUSY;

[Severity: Medium]
Is this check reachable? Looking at pqi_alloc_io_request(), when the second
argument is NULL, it enters an infinite loop until it successfully claims
an I/O slot:

drivers/scsi/smartpqi/smartpqi_init.c:pqi_alloc_io_request() {
	...
		while (1) {
			io_request = &ctrl_info->io_request_pool[ctrl_info->scsi_ml_can_queue + i];
			if (atomic_inc_return(&io_request->refcount) == 1)
				break;
			atomic_dec(&io_request->refcount);
			i = (i + 1) % PQI_RESERVED_IO_SLOTS;
		}
	...
}

Also, is it appropriate to return SCSI_MLQUEUE_HOST_BUSY here?

This is an internal synchronous routine which normally returns standard negative
errno values (like -ERESTARTSYS or -ENXIO). Returning a positive midlayer
queuecommand status code could lead to unhandled errors or undefined behavior
in the callers if the code were ever reached.

> +		goto out;
> +	}
>  
>  	put_unaligned_le16(io_request->index,
>  		&(((struct pqi_raid_path_request *)request)->request_id));

[ ... ]

> @@ -6370,6 +6374,9 @@ static int pqi_lun_reset(struct pqi_ctrl_info *ctrl_info, struct pqi_scsi_dev *d
>  	struct pqi_task_management_request *request;
>  
>  	io_request = pqi_alloc_io_request(ctrl_info, NULL);
> +	if (!io_request)
> +		return SCSI_MLQUEUE_HOST_BUSY;

[Severity: Medium]
Similarly, is it possible for pqi_alloc_io_request() to return NULL here?
Does returning SCSI_MLQUEUE_HOST_BUSY from this task management caller violate
standard error handling expectations?

> +
>  	io_request->io_complete_callback = pqi_lun_reset_complete;
>  	io_request->context = &wait;
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260817033505.736519-1-triet.hoang.dev@gmail.com?part=1

Re: [PATCH] scsi: smartpqi: Handle pqi_alloc_io_request() failure

[Markus Elfring]

> Check the return value of pqi_alloc_io_request() before dereferencing
> the returned request in pqi_submit_raid_request_synchronous() and
> pqi_lun_reset().

How do you think about to add any tags (like “Fixes” and “Cc”) accordingly?
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v7.2#n145
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/stable-kernel-rules.rst?h=v7.2#n34

Regards,
Markus

Re: [PATCH] scsi: smartpqi: Handle pqi_alloc_io_request() failure

[Don.Brace]

________________________________________
From: Triet Hoang <triet.hoang.dev@gmail.com>
Sent: Sunday, August 16, 2026 10:35 PM
To: Don Brace - C33706 <Don.Brace@microchip.com>
Cc: James.Bottomley@HansenPartnership.com <James.Bottomley@HansenPartnership.com>; martin.petersen@oracle.com <martin.petersen@oracle.com>; storagedev <storagedev@microchip.com>; linux-scsi@vger.kernel.org <linux-scsi@vger.kernel.org>; linux-kernel@vger.kernel.org <linux-kernel@vger.kernel.org>; Triet Hoang <triet.hoang.dev@gmail.com>
Subject: [PATCH] scsi: smartpqi: Handle pqi_alloc_io_request() failure
 

Check the return value of pqi_alloc_io_request() before dereferencing
the returned request in pqi_submit_raid_request_synchronous() and
pqi_lun_reset().

Return SCSI_MLQUEUE_HOST_BUSY when a request cannot be allocated so that
the operation can be retried instead of dereferencing a NULL pointer.

Signed-off-by: Triet Hoang <triet.hoang.dev@gmail.com>

For internal/IOCTL requests (scmd == NULL), pqi_alloc_io_request() blocks until
one of the reserved slots is free rather than failing, so these two call sites
can never observe NULL. Only the scmd != NULL path can return NULL, and those
four callers -- pqi_raid_submit_io(), pqi_aio_submit_io(),
pqi_aio_submit_r1_write_io() and pqi_aio_submit_r56_write_io() -- already check
for it.

SCSI_MLQUEUE_HOST_BUSY (0x1055) is also only meaningful as a queuecommand()
return value. pqi_submit_raid_request_synchronous() returns 0/-errno to its
callers, and in pqi_lun_reset() a 0x1055 return would fall into the retry loop
in pqi_lun_reset_with_retries(), adding 30 seconds of msleep() to error
recovery before failing.

Nacked-by: Don Brace <don.brace@microchip.com>

---
 drivers/scsi/smartpqi/smartpqi_init.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
index 5ec583dc2e7d..0930decef404 100644
--- a/drivers/scsi/smartpqi/smartpqi_init.c
+++ b/drivers/scsi/smartpqi/smartpqi_init.c
@@ -4667,6 +4667,10 @@ static int pqi_submit_raid_request_synchronous(struct pqi_ctrl_info *ctrl_info,
        }

        io_request = pqi_alloc_io_request(ctrl_info, NULL);
+       if (!io_request) {
+               rc = SCSI_MLQUEUE_HOST_BUSY;
+               goto out;
+       }

        put_unaligned_le16(io_request->index,
                &(((struct pqi_raid_path_request *)request)->request_id));
@@ -6353,6 +6357,9 @@ static int pqi_lun_reset(struct pqi_ctrl_info *ctrl_info, struct pqi_scsi_dev *d
        struct pqi_task_management_request *request;

        io_request = pqi_alloc_io_request(ctrl_info, NULL);
+       if (!io_request)
+               return SCSI_MLQUEUE_HOST_BUSY;
+
        io_request->io_complete_callback = pqi_lun_reset_complete;
        io_request->context = &wait;

--
2.53.0