Re: [PATCH v2] ata: libata-scsi: limit simulated SCSI command copy to response length

On Mon, Jul 6, 2026 at 6:10 PM Damien Le Moal <[email protected]> wrote:
>
> On 7/7/26 08:10, Karuna Ramkumar wrote:
> > Before I start working on this, I would love to hear your feedback on:
> > 1. Whether you think this API update (passing `rbuf_len` down to all
> > actors and helper functions) is the right approach, or if you prefer
> > simpler, and more localized checks elsewhere.
>
> I do not think it is necessary at all because rbuf is statically declared:
>
> static u8 ata_scsi_rbuf[ATA_SCSI_RBUF_SIZE];
>
> So the buffer address and maximum size is known to all functions using it.
>
> > 2. What would be the best way to test all these simulated command
> > paths to ensure the fix is verified appropriately?
>
> Most functions for emulated commands generate only a very small amount of data,
> far below ATA_SCSI_RBUF_SIZE. So I would suggest that we simply add checks to
> the functions which may potentially exceed that. Off the top of my head, I do
> not know if we have any, but we should just check.
>
> Note that ideally, we should have each function allocate their own local buffer
> to handle the translation. But this is right now a little hard to do because
> these translation/emulation functions are called with the port locked, so we
> would have a memory allocation for a potentially large-ish buffer under a spin
> lock, which means no reclaim/no wait allocation, and thus potential for failure
> which we do not have right now. A proper/ideal fix would need to drop
> ata_scsi_rbuf, have some helpers for managing the internal buffer and redesign
> the submission path to not have the port locked until the translation is
> actually generated. That is all more work and more changes.
>
> So as a first step, let's check the emulation function if any of them can exceed
> ATA_SCSI_RBUF_SIZE in size, fail them with internal target failure.

Hi Damien,

I went through all the SCSI actor functions in libata-scsi.c and
calculated their maximum size consumption.

As you mentioned, most command emulations triggered via actor
callbacks write a fixed or small amount of payload, and are well
within the 2048 byte limit of `ata_scsi_rbuf`.

There are two functions that can potentially overflow though:

1. ata_scsiop_inq_b9: Writes 64 + nr_cpr * 32 bytes. If nr_cpr crosses
62, then this can cause an overflow
2. ata_format_dsm_trim_descr: Writes trmax * 8 bytes. If trmax > 2048
/ 8, then this can cause an overflow too.

I will prepare a patch to add bounds checks to these two functions and
send it over for review. Please let me know if you have any
suggestions/concerns.

Thanks,
Karuna

>
> --
> Damien Le Moal
> Western Digital Research