Re: [PATCH v2] ata: libata-scsi: limit simulated SCSI command copy to response length

On 7/7/26 08:10, Karuna Ramkumar wrote:
> Before I start working on this, I would love to hear your feedback on:
> 1. Whether you think this API update (passing `rbuf_len` down to all
> actors and helper functions) is the right approach, or if you prefer
> simpler, and more localized checks elsewhere.

I do not think it is necessary at all because rbuf is statically declared:

static u8 ata_scsi_rbuf[ATA_SCSI_RBUF_SIZE];

So the buffer address and maximum size is known to all functions using it.

> 2. What would be the best way to test all these simulated command
> paths to ensure the fix is verified appropriately?

Most functions for emulated commands generate only a very small amount of data,
far below ATA_SCSI_RBUF_SIZE. So I would suggest that we simply add checks to
the functions which may potentially exceed that. Off the top of my head, I do
not know if we have any, but we should just check.

Note that ideally, we should have each function allocate their own local buffer
to handle the translation. But this is right now a little hard to do because
these translation/emulation functions are called with the port locked, so we
would have a memory allocation for a potentially large-ish buffer under a spin
lock, which means no reclaim/no wait allocation, and thus potential for failure
which we do not have right now. A proper/ideal fix would need to drop
ata_scsi_rbuf, have some helpers for managing the internal buffer and redesign
the submission path to not have the port locked until the translation is
actually generated. That is all more work and more changes.

So as a first step, let's check the emulation function if any of them can exceed
ATA_SCSI_RBUF_SIZE in size, fail them with internal target failure.

-- 
Damien Le Moal
Western Digital Research