Re: [PATCH 2/3] scsi: aic94xx: validate the EDB index in asd_get_response_tasklet()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] scsi: aic94xx: dropped task response leads to false-positive SUCCESS
--

commit 01f64db51b53d15913fd46e2c3fef1fd65e921d6
Author: Yehyeong Lee <yhlee@isslab.korea.ac.kr>

scsi: aic94xx: validate the EDB index in asd_get_response_tasklet()

This commit validates the empty data buffer index in
asd_get_response_tasklet() to prevent out-of-bounds array access. If the
sequencer returns an invalid edb_id, the driver now prints a debug message
and returns early.

> diff --git a/drivers/scsi/aic94xx/aic94xx_task.c b/drivers/scsi/aic94xx/aic94xx_task.c
> index b26a468ddc981..35cf61f541d1b 100644
> --- a/drivers/scsi/aic94xx/aic94xx_task.c
> +++ b/drivers/scsi/aic94xx/aic94xx_task.c
> @@ -169,6 +169,12 @@ static void asd_get_response_tasklet(struct asd_ascb *ascb,
>  		return;
>  	}
>  
> +	if (edb_id < 0 || edb_id >= ASD_EDBS_PER_SCB) {
> +		ASD_DPRINTK("edb_id is %d! resp_sb->flags is 0x%x\n",
> +			    edb_id, resp_sb->flags);
> +		return;
> +	}
        ^^^^^^^

[Severity: Medium]
Does returning early here leave the task status as SAS_PROTO_RESPONSE?

If this return is taken, ts->stat is not updated to an error status. For SSP
tasks, sas_end_task() in libsas maps SAS_PROTO_RESPONSE to DID_OK and
SAS_SAM_STAT_GOOD. For ATA tasks, libsas parses the task's uninitialized
response buffer, resulting in no error mask.

Could this lead to a false-positive task success, masking hardware errors or
causing silent data corruption if data was not actually transferred?

> +
>  	ts->buf_valid_size = 0;
>  	edb = asd_ha->seq.edb_arr[edb_id + escb->edb_index];
>  	r = edb->vaddr;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015072612.4144043-1-yhlee@isslab.korea.ac.kr?part=2