Re: [PATCH v2] ata: libata-scsi: limit sim ulated SCSI command copy to response length

On 9 July 2026 05:34:14 CEST, Karuna Ramkumar <[email protected]> wrote:
>On Mon, Jul 6, 2026 at 6:10 PM Damien Le Moal <[email protected]> wrote:
>>
>> On 7/7/26 08:10, Karuna Ramkumar wrote:
>> > Before I start working on this, I would love to hear your feedback on:
>> > 1. Whether you think this API update (passing `rbuf_len` down to all
>> > actors and helper functions) is the right approach, or if you prefer
>> > simpler, and more localized checks elsewhere.
>>
>> I do not think it is necessary at all because rbuf is statically declared:
>>
>> static u8 ata_scsi_rbuf[ATA_SCSI_RBUF_SIZE];
>>
>> So the buffer address and maximum size is known to all functions using it.
>>
>> > 2. What would be the best way to test all these simulated command
>> > paths to ensure the fix is verified appropriately?
>>
>> Most functions for emulated commands generate only a very small amount of data,
>> far below ATA_SCSI_RBUF_SIZE. So I would suggest that we simply add checks to
>> the functions which may potentially exceed that. Off the top of my head, I do
>> not know if we have any, but we should just check.
>>
>> Note that ideally, we should have each function allocate their own local buffer
>> to handle the translation. But this is right now a little hard to do because
>> these translation/emulation functions are called with the port locked, so we
>> would have a memory allocation for a potentially large-ish buffer under a spin
>> lock, which means no reclaim/no wait allocation, and thus potential for failure
>> which we do not have right now. A proper/ideal fix would need to drop
>> ata_scsi_rbuf, have some helpers for managing the internal buffer and redesign
>> the submission path to not have the port locked until the translation is
>> actually generated. That is all more work and more changes.
>>
>> So as a first step, let's check the emulation function if any of them can exceed
>> ATA_SCSI_RBUF_SIZE in size, fail them with internal target failure.
>
>Hi Damien,
>
>I went through all the SCSI actor functions in libata-scsi.c and
>calculated their maximum size consumption.
>
>As you mentioned, most command emulations triggered via actor
>callbacks write a fixed or small amount of payload, and are well
>within the 2048 byte limit of `ata_scsi_rbuf`.
>
>There are two functions that can potentially overflow though:
>
>1. ata_scsiop_inq_b9: Writes 64 + nr_cpr * 32 bytes. If nr_cpr crosses
>62, then this can cause an overflow
>2. ata_format_dsm_trim_descr: Writes trmax * 8 bytes. If trmax > 2048
>/ 8, then this can cause an overflow too.
>


Please note that ata_format_dsm_trim_descr()
was changed recently, on libata for-7.3 branch:

https://git.kernel.org/pub/scm/linux/kernel/git/libata/linux.git/log/?h=for-7.3

I don't think that this function can overflow anymore.


Kind regards,
Niklas