| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <202510031227.18psESZQ-lkp@intel.com>
Date: Fri, 3 Oct 2025 11:40:33 +0300
From: Dan Carpenter <dan.carpenter@...aro.org>
To: oe-kbuild@...ts.linux.dev, Tony Battersby <tonyb@...ernetics.com>,
Nilesh Javali <njavali@...vell.com>,
GR-QLogic-Storage-Upstream@...vell.com,
"James E.J. Bottomley" <James.Bottomley@...senpartnership.com>,
"Martin K. Petersen" <martin.petersen@...cle.com>
Cc: lkp@...el.com, oe-kbuild-all@...ts.linux.dev,
linux-scsi <linux-scsi@...r.kernel.org>,
target-devel@...r.kernel.org, scst-devel@...ts.sourceforge.net,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
Dmitry Bogdanov <d.bogdanov@...ro.com>,
Xose Vazquez Perez <xose.vazquez@...il.com>
Subject: Re: [PATCH v2 11/16] scsi: qla2xxx: fix TMR failure handling
Hi Tony,
kernel test robot noticed the following build warnings:
url: https://github.com/intel-lab-lkp/linux/commits/Tony-Battersby/Revert-scsi-qla2xxx-Perform-lockless-command-completion-in-abort-path/20250930-024814
base: e5f0a698b34ed76002dc5cff3804a61c80233a7a
patch link: https://lore.kernel.org/r/f52cda16-4952-4b28-bbf7-d44f4e054490%40cybernetics.com
patch subject: [PATCH v2 11/16] scsi: qla2xxx: fix TMR failure handling
config: i386-randconfig-141-20251002 (https://download.01.org/0day-ci/archive/20251003/202510031227.18psESZQ-lkp@intel.com/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@...el.com>
| Reported-by: Dan Carpenter <dan.carpenter@...aro.org>
| Closes: https://lore.kernel.org/r/202510031227.18psESZQ-lkp@intel.com/
New smatch warnings:
drivers/scsi/qla2xxx/qla_target.c:5735 qlt_handle_abts_completion() error: we previously assumed 'mcmd' could be null (see line 5723)
Old smatch warnings:
drivers/scsi/qla2xxx/qla_target.c:671 qla24xx_delete_sess_fn() warn: can 'fcport' even be NULL?
vim +/mcmd +5735 drivers/scsi/qla2xxx/qla_target.c
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5706 static void qlt_handle_abts_completion(struct scsi_qla_host *vha,
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5707 struct rsp_que *rsp, response_t *pkt)
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5708 {
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5709 struct abts_resp_from_24xx_fw *entry =
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5710 (struct abts_resp_from_24xx_fw *)pkt;
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5711 u32 h = pkt->handle & ~QLA_TGT_HANDLE_MASK;
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5712 struct qla_tgt_mgmt_cmd *mcmd;
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5713 struct qla_hw_data *ha = vha->hw;
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5714
81bcf1c5cf0ee87 Bart Van Assche 2019-04-11 5715 mcmd = qlt_ctio_to_cmd(vha, rsp, pkt->handle, pkt);
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5716 if (mcmd == NULL && h != QLA_TGT_SKIP_HANDLE) {
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5717 ql_dbg(ql_dbg_async, vha, 0xe064,
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5718 "qla_target(%d): ABTS Comp without mcmd\n",
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5719 vha->vp_idx);
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5720 return;
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5721 }
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5722
6b0431d6fa20bd1 Quinn Tran 2018-09-04 @5723 if (mcmd)
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5724 vha = mcmd->vha;
mcmd can be NULL
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5725 vha->vha_tgt.qla_tgt->abts_resp_expected--;
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5726
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5727 ql_dbg(ql_dbg_tgt, vha, 0xe038,
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5728 "ABTS_RESP_24XX: compl_status %x\n",
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5729 entry->compl_status);
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5730
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5731 if (le16_to_cpu(entry->compl_status) != ABTS_RESP_COMPL_SUCCESS) {
7ffa5b939751b66 Bart Van Assche 2020-05-18 5732 if (le32_to_cpu(entry->error_subcode1) == 0x1E &&
7ffa5b939751b66 Bart Van Assche 2020-05-18 5733 le32_to_cpu(entry->error_subcode2) == 0) {
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5734 if (qlt_chk_unresolv_exchg(vha, rsp->qpair, entry)) {
74dabbbd8bb833e Tony Battersby 2025-09-29 @5735 qlt_free_ul_mcmd(ha, mcmd);
^^^^
But here it is dereferenced without checking. Previously it called
tcm_qla2xxx_free_mcmd() which checks for NULL.
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5736 return;
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5737 }
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5738 qlt_24xx_retry_term_exchange(vha, rsp->qpair,
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5739 pkt, mcmd);
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5740 } else {
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5741 ql_dbg(ql_dbg_tgt, vha, 0xe063,
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5742 "qla_target(%d): ABTS_RESP_24XX failed %x (subcode %x:%x)",
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5743 vha->vp_idx, entry->compl_status,
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5744 entry->error_subcode1,
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5745 entry->error_subcode2);
74dabbbd8bb833e Tony Battersby 2025-09-29 5746 qlt_free_ul_mcmd(ha, mcmd);
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5747 }
e752a04e1bd14cc Bart Van Assche 2019-08-08 5748 } else if (mcmd) {
74dabbbd8bb833e Tony Battersby 2025-09-29 5749 qlt_free_ul_mcmd(ha, mcmd);
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5750 }
6b0431d6fa20bd1 Quinn Tran 2018-09-04 5751 }
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Powered by blists - more mailing lists