Re: [PATCH] scsi: target: tcm_fc: reject overlapping write-data frames

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] tcm_fc: missing segment merge causes premature exhaustion of write_seg array
--

commit 0b59be7f471ca24ee5e88d2fb9a9cd36b483ea6a
Author: Yehyeong Lee <yhlee@isslab.korea.ac.kr>

scsi: target: tcm_fc: reject overlapping write-data frames

This patch tracks received write ranges for out-of-order FCP frames to
drop frames that repeat already received data. It introduces an array to
hold disconnected segments, preventing overlapping frames from leaving
unwritten gaps in the data buffer.

Fixes: 3699d92a4d7b ("[SCSI] tcm_fc: Adding FC_FC4 provider (tcm_fc) for FCoE target (TCM - target core) support")
Cc: stable@vger.kernel.org

> diff --git a/drivers/target/tcm_fc/tfc_io.c b/drivers/target/tcm_fc/tfc_io.c
> index 45329284f52f5..53d7c7268865d 100644
> --- a/drivers/target/tcm_fc/tfc_io.c
> +++ b/drivers/target/tcm_fc/tfc_io.c
[ ... ]
> +static bool ft_add_write_range(struct ft_cmd *cmd, u32 off, u32 len)
> +{
[ ... ]
> +	if (off != cmd->write_contig_end) {
> +		for (i = 0; i < cmd->write_nseg; i++) {
> +			if (cmd->write_seg[i].end == off) {
> +				cmd->write_seg[i].end = end;
> +				return true;
> +			}
> +			if (cmd->write_seg[i].off == end) {
> +				cmd->write_seg[i].off = off;
> +				return true;
> +			}

[Severity: Medium]
When an out-of-order write frame extends the boundary of an existing tracked
segment, does returning true immediately bypass any logic to check if this
extension makes the segment contiguous with another tracked segment?

If adjacent segments are not coalesced (unless they directly touch
cmd->write_contig_end), could this tracking array artificially waste slots on
segments that are now adjacent to each other?

> +		}
> +		if (cmd->write_nseg >= FT_WRITE_SEGS)
> +			return false;

[Severity: Medium]
Due to the missing merge logic mentioned above, could the array remain
artificially full of adjacent segments, erroneously triggering this limit
and dropping valid incoming data frames?

If an initiator sends heavily fragmented out-of-order frames, the array
could quickly fill with unmerged adjacent segments. Would subsequent
valid non-adjacent frames then be dropped with a misleading "repeats data"
error, potentially causing FC sequence timeouts, FCP exchange aborts, and
transport layer failures on the initiator?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/506886f3051941899c26b3dd4d2a32a3c0cf9846.1791812937.git.yhlee@isslab.korea.ac.kr?part=1