Re: [PATCH v8 11/27] scsi-multipath: introduce basic SCSI device support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] scsi_mpath_unique_lun_id ignores string truncation of the unique LUN ID, risking incorrect multipath grouping.
--

commit 1346e25fe4922ff0f78a31848664daccf7121f0f
Author: John Garry <john.garry@linux.dev>

scsi-multipath: introduce basic SCSI device support

For a scsi_device to support multipath, introduce structure
scsi_mpath_device to hold multipath-specific details. A module param
is introduced to enable multipath. SCSI multipath will only be
available when supported and unique ID is available in VPD page 83.

> diff --git a/drivers/scsi/scsi_multipath.c b/drivers/scsi/scsi_multipath.c
> new file mode 100644
> index 0000000000000..5559e2e8d64a8
> --- /dev/null
> +++ b/drivers/scsi/scsi_multipath.c
[ ... ]
> +static int scsi_mpath_unique_lun_id(struct scsi_device *sdev)
> +{
> +	struct scsi_mpath_device *scsi_mpath_dev = sdev->scsi_mpath_dev;
> +	int ret;
> +
> +	ret = scsi_vpd_lun_id(sdev, scsi_mpath_dev->device_id_str,
> +				SCSI_MPATH_DEVICE_ID_LEN);
> +	if (ret < 0)
> +		return ret;
> +	else if (ret == 0)
> +		return -EINVAL;
> +
> +	return 0;

[Severity: Medium]
Can the LUN ID be silently truncated here without returning an error?

Similar to snprintf, scsi_vpd_lun_id returns the number of bytes that would
have been written. If a device provides a pathological T10 Vendor ID that
causes the expanded string to exceed SCSI_MPATH_DEVICE_ID_LEN (256 bytes),
the string in the buffer is truncated but the returned length will be
greater than or equal to SCSI_MPATH_DEVICE_ID_LEN.

Because any positive value of ret results in returning 0, a truncated ID
will be treated as a success. If the unique identifier portion of the ID is
pushed past the 255th byte, multiple distinct LUNs might share the exact same
255-character prefix and be incorrectly grouped together by
scsi_mpath_find_head.

> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260907105021.1763236-1-john.g.garry@oracle.com?part=11