RE: [EXTERNAL] [PATCH] scsi: qla2xxx: Fix BSG vendor overlays missed by request_len validation

[Nilesh Javali]

Hi Zizhi Wo,

In our internal testing we observed that the commit 4cf38dd94657 ("scsi: qla2xxx: Validate BSG request_len before
reading vendor_cmd[]") causes the application to take longer time to start. I would be reverting this commit
in my next patch set. Thank you for your patch.

Thanks,
Nilesh




From: Zizhi Wo <wozizhi@xxxxxxxxxx> 
Sent: Monday, October 19, 2026 6:19 PM
To: Nilesh Javali <njavali@xxxxxxxxxxx>; GR-QLogic-Storage-Upstream@xxxxxxxxxxx; James.Bottomley@xxxxxxxxxxxxxxxxxxxxx; mkp@xxxxxxxxxx; linux-scsi@xxxxxxxxxxxxxxx
Cc: linux-kernel@xxxxxxxxxxxxxxx; yangerkun@xxxxxxxxxx; chengzhihao1@xxxxxxxxxx; wozizhi@xxxxxxxxxx
Subject: [EXTERNAL] [PATCH] scsi: qla2xxx: Fix BSG vendor overlays missed by request_len validation

Commit 4cf38dd94657 ("scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]") added a central check in qla2x00_process_vendor_specific() and per-handler checks for the vendor_cmd[] accesses, but it missed two handlers that compute
ZjQcmQRYFpfptBannerStart
Prioritize security for external emails: 
Confirm sender and content safety before clicking links or opening attachments 
  https://us-phishalarm-ewt.proofpoint.com/EWT/v1/CRVmXkqW!tY3Z1f8UYlXa1S-c-Vxazp44dpyDcFqDyzlya7BttdK_BPDvc-jp3gGlKmn9UFXGc18ON_sP1B5YHA_ya4qu98P2uEsU$  ‌; 


ZjQcmQRYFpfptBannerEnd
Commit 4cf38dd94657 ("scsi: qla2xxx: Validate BSG request_len before
reading vendor_cmd[]") added a central check in
qla2x00_process_vendor_specific() and per-handler checks for the
vendor_cmd[] accesses, but it missed two handlers that compute the same
request offset with pointer arithmetic:

	ql84_mgmt  = (void *)bsg_request + sizeof(struct fc_bsg_request);
	port_param = (void *)bsg_request + sizeof(struct fc_bsg_request);

qla84xx_mgmt_cmd() overlays struct qla_bsg_a84_mgmt at offset 20 and reads
mgmt.mgmtp at offset 24 and mgmt.len at offset 36. The structure is 20
bytes long, so the handler needs request_len >= 40, while the central check
only guarantees 24 bytes (sizeof(struct fc_bsg_request) + sizeof(u32)).
qla24xx_iidma() has the same problem with struct qla_port_param.

Validate the full overlay structure in both handlers.

Fixes: 01e0e15c8b3b ("scsi: don't use fc_bsg_job::request and fc_bsg_job::reply directly")
Signed-off-by: Zizhi Wo <mailto:wozizhi@xxxxxxxxxx>
---
 drivers/scsi/qla2xxx/qla_bsg.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c
index ab559048dbb8..e86ab83300b5 100644
--- a/drivers/scsi/qla2xxx/qla_bsg.c
+++ b/drivers/scsi/qla2xxx/qla_bsg.c
@@ -1159,10 +1159,14 @@ qla84xx_mgmt_cmd(struct bsg_job *bsg_job)
 		ql_log(ql_log_warn, vha, 0x703a,
 		    "Not 84xx, exiting.\n");
 		return -EINVAL;
 	}
 
+	if (bsg_job->request_len <
+	    sizeof(struct fc_bsg_request) + sizeof(struct qla_bsg_a84_mgmt))
+		return -EINVAL;
+
 	mn = dma_pool_zalloc(ha->s_dma_pool, GFP_KERNEL, &mn_dma);
 	if (!mn) {
 		ql_log(ql_log_warn, vha, 0x703c,
 		    "DMA alloc failed for fw buffer.\n");
 		return -ENOMEM;
@@ -1351,10 +1355,14 @@ qla24xx_iidma(struct bsg_job *bsg_job)
 	if (!IS_IIDMA_CAPABLE(vha->hw)) {
 		ql_log(ql_log_info, vha, 0x7046, "iiDMA not supported.\n");
 		return -EINVAL;
 	}
 
+	if (bsg_job->request_len <
+	    sizeof(struct fc_bsg_request) + sizeof(struct qla_port_param))
+		return -EINVAL;
+
 	port_param = (void *)bsg_request + sizeof(struct fc_bsg_request);
 	if (port_param->fc_scsi_addr.dest_type != EXT_DEF_TYPE_WWPN) {
 		ql_log(ql_log_warn, vha, 0x7048,
 		    "Invalid destination type.\n");
 		return -EINVAL;
-- 
2.52.0