| Message ID | 20260903034201.112211-34-dlemoal@kernel.org |
|---|---|
| State | New |
| Headers | show |
| Series | Use defined 16-bits ASC/ASCQ combinations | expand |
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: Pre-existing issues: - [High] The `sense_hdr` structure is read uninitialized in `storvsc_handle_error` if a command completes with `scsi_status == 0` but an SRB error status and the AUTOSENSE_VALID flag set. -- commit 08f20503dd93893c68326306a042bfdb6e31394b Author: Damien Le Moal <dlemoal@kernel.org> scsi: storvsc: use 16-bits defined sense codes This commit refactors the storvsc driver to use the 16-bit sense_code field of struct scsi_sense_hdr and replaces hard-coded additional sense codes with enum values defined in include/scsi/scsi_sense.h. > diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c > index ef3cd3bc7390e..625db97d1a03e 100644 > --- a/drivers/scsi/storvsc_drv.c > +++ b/drivers/scsi/storvsc_drv.c [ ... ] > @@ -1141,8 +1145,7 @@ static void storvsc_command_completion(struct storvsc_cmd_request *cmd_request, > } > > if (vm_srb->srb_status != SRB_STATUS_SUCCESS) { > - storvsc_handle_error(vm_srb, scmnd, host, sense_hdr.asc, > - sense_hdr.ascq); > + storvsc_handle_error(vm_srb, scmnd, host, &sense_hdr); [Severity: High] This isn't a bug introduced by this patch, but does passing &sense_hdr here risk reading uninitialized memory if the command completes with scsi_status == 0? In storvsc_command_completion(), sense_hdr is declared on the stack without initialization. It is only populated if scmnd->result is non-zero: storvsc_command_completion() { struct scsi_sense_hdr sense_hdr; ... if (scmnd->result) { sense_ok = scsi_normalize_sense(..., &sense_hdr); ... } if (vm_srb->srb_status != SRB_STATUS_SUCCESS) { storvsc_handle_error(vm_srb, scmnd, host, &sense_hdr); If the Hyper-V host returns scsi_status == 0 but an SRB error occurred (for example, with AUTOSENSE_VALID set), storvsc_handle_error() is called with the uninitialized sense_hdr. Inside storvsc_handle_error(), this leads directly to evaluating uninitialized stack memory when checking sshdr->sense_code for CAPACITY_DATA_HAS_CHANGED or other statuses. > /* > * The Windows driver set data_transfer_length on > * SRB_STATUS_DATA_OVERRUN. On other errors, this value
On 9/3/26 5:41 AM, Damien Le Moal wrote: > Refactor the storvsc driver to use the 16-bits sense_code field of > struct scsi_sense_hdr and replace all hard-coded additional sense codes > and additional sense code qualifiers with the enum values defined in > include/scsi/scsi_sense.h. This helps with code clarity as the sense codes > being processed are easier to test and self-documented. > > No functional change intended. > > Signed-off-by: Damien Le Moal <dlemoal@kernel.org> > --- > drivers/scsi/storvsc_drv.c | 15 +++++++++------ > 1 file changed, 9 insertions(+), 6 deletions(-) > Reviewed-by: Hannes Reinecke <hare@kernel.org> Cheers, Hannes
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c index ef3cd3bc7390..625db97d1a03 100644 --- a/drivers/scsi/storvsc_drv.c +++ b/drivers/scsi/storvsc_drv.c @@ -1016,7 +1016,7 @@ static int storvsc_channel_init(struct hv_device *device, bool is_fc) static void storvsc_handle_error(struct vmscsi_request *vm_srb, struct scsi_cmnd *scmnd, struct Scsi_Host *host, - u8 asc, u8 ascq) + struct scsi_sense_hdr *sshdr) { struct storvsc_scan_work *wrk; void (*process_err_fn)(struct work_struct *work); @@ -1033,7 +1033,7 @@ static void storvsc_handle_error(struct vmscsi_request *vm_srb, case SRB_STATUS_DATA_OVERRUN: if (vm_srb->srb_status & SRB_STATUS_AUTOSENSE_VALID) { /* Check for capacity change */ - if ((asc == 0x2a) && (ascq == 0x9)) { + if (sshdr->sense_code == CAPACITY_DATA_HAS_CHANGED) { process_err_fn = storvsc_device_scan; /* Retry the I/O that triggered this. */ set_host_byte(scmnd, DID_REQUEUE); @@ -1049,8 +1049,12 @@ static void storvsc_handle_error(struct vmscsi_request *vm_srb, * want scsi_report_sense() to output a message * that a sysadmin wouldn't know what to do with. */ - if ((asc == 0x3f) && (ascq != 0x03) && - (ascq != 0x0e)) { + if (scsi_sense_asc(sshdr) == + ASC_TARGET_OPERATING_CONDITIONS_HAVE_CHANGED && + sshdr->sense_code != + INQUIRY_DATA_HAS_CHANGED && + sshdr->sense_code != + REPORTED_LUNS_DATA_HAS_CHANGED) { process_err_fn = storvsc_device_scan; set_host_byte(scmnd, DID_REQUEUE); goto do_work; @@ -1141,8 +1145,7 @@ static void storvsc_command_completion(struct storvsc_cmd_request *cmd_request, } if (vm_srb->srb_status != SRB_STATUS_SUCCESS) { - storvsc_handle_error(vm_srb, scmnd, host, sense_hdr.asc, - sense_hdr.ascq); + storvsc_handle_error(vm_srb, scmnd, host, &sense_hdr); /* * The Windows driver set data_transfer_length on * SRB_STATUS_DATA_OVERRUN. On other errors, this value
Refactor the storvsc driver to use the 16-bits sense_code field of struct scsi_sense_hdr and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal <dlemoal@kernel.org> --- drivers/scsi/storvsc_drv.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)