From patchwork Tue Jun 26 07:18:37 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Damien Le Moal X-Patchwork-Id: 10488103 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 9CFBB60386 for ; Tue, 26 Jun 2018 07:18:52 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 87D9726419 for ; Tue, 26 Jun 2018 07:18:52 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 7C2EE277D9; Tue, 26 Jun 2018 07:18:52 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2E71D26419 for ; Tue, 26 Jun 2018 07:18:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752164AbeFZHSt (ORCPT ); Tue, 26 Jun 2018 03:18:49 -0400 Received: from esa5.hgst.iphmx.com ([216.71.153.144]:30387 "EHLO esa5.hgst.iphmx.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752328AbeFZHSm (ORCPT ); Tue, 26 Jun 2018 03:18:42 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=wdc.com; i=@wdc.com; q=dns/txt; s=dkim.wdc.com; t=1529997523; x=1561533523; h=from:to:cc:subject:date:message-id:in-reply-to: references; bh=kyRjqMZ6ijjOF+1hNjUdIv86HJYvJiTpF8PugJJfdig=; b=Cx2i5Lm2Rt0tm1o8xkrOc0A/GadXIUxeIjel9DiKkIRn5m9CxGU2Ddh4 0Y+lxhbRPzTWfzG2hJ93w1XLeTXi/3OPpSZUeWHysY4dV+0shxdJyi7fV VTKWzidSHbUvhRu7ts+7Ns525qqTXCNXbrYiPBhhLL62hTr0Thx3RiyT9 mFBGhmqBlRF3SMz9o1grsc6h9evTUKNKniVQEp4FIyfqQMg4DnFV80GCw tgEIOnny2VNKTC47MUrmFMc29fKrh9G6D4bQ1B11z/jyNbcOuDLuv6jbI 2Hwr1ueSfFyqc1XJK0j/JL8tA/0wuexKQwzmVSnDCmMoaalxWzY8j0ZtL w==; X-IronPort-AV: E=Sophos;i="5.51,273,1526313600"; d="scan'208";a="82452404" Received: from uls-op-cesaip02.wdc.com (HELO uls-op-cesaep02.wdc.com) ([199.255.45.15]) by ob1.hgst.iphmx.com with ESMTP; 26 Jun 2018 15:18:43 +0800 Received: from uls-op-cesaip02.wdc.com ([10.248.3.37]) by uls-op-cesaep02.wdc.com with ESMTP; 26 Jun 2018 00:08:01 -0700 Received: from washi.fujisawa.hgst.com ([10.149.53.254]) by uls-op-cesaip02.wdc.com with ESMTP; 26 Jun 2018 00:18:40 -0700 From: Damien Le Moal To: Tejun Heo , linux-ide@vger.kernel.org Cc: linux-scsi@vger.kernel.org, "Martin K . Petersen" , Bart Van Assche , Hannes Reinecke , stable@vger.kernel.org Subject: [PATCH 1/2] ata: Fix ZBC_OUT command block check Date: Tue, 26 Jun 2018 16:18:37 +0900 Message-Id: <20180626071838.15140-2-damien.lemoal@wdc.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20180626071838.15140-1-damien.lemoal@wdc.com> References: <20180626071838.15140-1-damien.lemoal@wdc.com> Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The block (LBA) specified must not exceed the last addressable LBA, which is dev->nr_sectors - 1. So fix the correct check is "if (block >= dev->n_sectors)" and not "if (block > dev->n_sectords)". Additionally, the asc/ascq to return for an LBA that is not a zone start LBA should be ILLEGAL REQUEST, regardless if the bad LBA is out of range. Reported-by: David Butterfield Signed-off-by: Damien Le Moal --- drivers/ata/libata-scsi.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c index 6a91d04351d9..a5543751f446 100644 --- a/drivers/ata/libata-scsi.c +++ b/drivers/ata/libata-scsi.c @@ -3805,8 +3805,13 @@ static unsigned int ata_scsi_zbc_out_xlat(struct ata_queued_cmd *qc) */ goto invalid_param_len; } - if (block > dev->n_sectors) - goto out_of_range; + if (block >= dev->n_sectors) { + /* + * Block must be a valid zone ID (a zone start LBA). + */ + fp = 2; + goto invalid_fld; + } all = cdb[14] & 0x1; @@ -3837,10 +3842,6 @@ static unsigned int ata_scsi_zbc_out_xlat(struct ata_queued_cmd *qc) invalid_fld: ata_scsi_set_invalid_field(qc->dev, scmd, fp, 0xff); return 1; - out_of_range: - /* "Logical Block Address out of range" */ - ata_scsi_set_sense(qc->dev, scmd, ILLEGAL_REQUEST, 0x21, 0x00); - return 1; invalid_param_len: /* "Parameter list length error" */ ata_scsi_set_sense(qc->dev, scmd, ILLEGAL_REQUEST, 0x1a, 0x0);