Re: [PATCH v2] ata: libata-scsi: limit simulated SCSI command copy to response length

On Thu, Jul 9, 2026 at 6:11 AM Niklas Cassel <[email protected]> wrote:
>
> On 9 July 2026 05:34:14 CEST, Karuna Ramkumar <[email protected]> wrote:
> >On Mon, Jul 6, 2026 at 6:10 PM Damien Le Moal <[email protected]> wrote:
> >>
> >> On 7/7/26 08:10, Karuna Ramkumar wrote:
> >> > Before I start working on this, I would love to hear your feedback on:
> >> > 1. Whether you think this API update (passing `rbuf_len` down to all
> >> > actors and helper functions) is the right approach, or if you prefer
> >> > simpler, and more localized checks elsewhere.
> >>
> >> I do not think it is necessary at all because rbuf is statically declared:
> >>
> >> static u8 ata_scsi_rbuf[ATA_SCSI_RBUF_SIZE];
> >>
> >> So the buffer address and maximum size is known to all functions using it.
> >>
> >> > 2. What would be the best way to test all these simulated command
> >> > paths to ensure the fix is verified appropriately?
> >>
> >> Most functions for emulated commands generate only a very small amount of data,
> >> far below ATA_SCSI_RBUF_SIZE. So I would suggest that we simply add checks to
> >> the functions which may potentially exceed that. Off the top of my head, I do
> >> not know if we have any, but we should just check.
> >>
> >> Note that ideally, we should have each function allocate their own local buffer
> >> to handle the translation. But this is right now a little hard to do because
> >> these translation/emulation functions are called with the port locked, so we
> >> would have a memory allocation for a potentially large-ish buffer under a spin
> >> lock, which means no reclaim/no wait allocation, and thus potential for failure
> >> which we do not have right now. A proper/ideal fix would need to drop
> >> ata_scsi_rbuf, have some helpers for managing the internal buffer and redesign
> >> the submission path to not have the port locked until the translation is
> >> actually generated. That is all more work and more changes.
> >>
> >> So as a first step, let's check the emulation function if any of them can exceed
> >> ATA_SCSI_RBUF_SIZE in size, fail them with internal target failure.
> >
> >Hi Damien,
> >
> >I went through all the SCSI actor functions in libata-scsi.c and
> >calculated their maximum size consumption.
> >
> >As you mentioned, most command emulations triggered via actor
> >callbacks write a fixed or small amount of payload, and are well
> >within the 2048 byte limit of `ata_scsi_rbuf`.
> >
> >There are two functions that can potentially overflow though:
> >
> >1. ata_scsiop_inq_b9: Writes 64 + nr_cpr * 32 bytes. If nr_cpr crosses
> >62, then this can cause an overflow
> >2. ata_format_dsm_trim_descr: Writes trmax * 8 bytes. If trmax > 2048
> >/ 8, then this can cause an overflow too.
> >
>
>
> Please note that ata_format_dsm_trim_descr()
> was changed recently, on libata for-7.3 branch:
>
> https://git.kernel.org/pub/scm/linux/kernel/git/libata/linux.git/log/?h=for-7.3
>
> I don't think that this function can overflow anymore.

Hi Niklas,

Thanks for the heads up! Since ata_format_dsm_trim_descr() is already
fixed, I created a patch for ata_scsiop_inq_b9 and pushed it upstream
for review.

https://lore.kernel.org/all/[email protected]/

Thanks,
Karuna
>
>
> Kind regards,
> Niklas