Re: [PATCH v2] ata: libata-scsi: limit simulated SCSI command copy to response length

On 7/9/26 12:34, Karuna Ramkumar wrote:
> Hi Damien,
> 
> I went through all the SCSI actor functions in libata-scsi.c and
> calculated their maximum size consumption.
> 
> As you mentioned, most command emulations triggered via actor
> callbacks write a fixed or small amount of payload, and are well
> within the 2048 byte limit of `ata_scsi_rbuf`.
> 
> There are two functions that can potentially overflow though:
> 
> 1. ata_scsiop_inq_b9: Writes 64 + nr_cpr * 32 bytes. If nr_cpr crosses
> 62, then this can cause an overflow
> 2. ata_format_dsm_trim_descr: Writes trmax * 8 bytes. If trmax > 2048
> / 8, then this can cause an overflow too.
> 
> I will prepare a patch to add bounds checks to these two functions and
> send it over for review. Please let me know if you have any
> suggestions/concerns.

Sounds good. Thanks.

-- 
Damien Le Moal
Western Digital Research