From patchwork Tue Jun 26 11:56:54 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Damien Le Moal X-Patchwork-Id: 10488787 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 1F4B9602D8 for ; Tue, 26 Jun 2018 11:57:09 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 16FF72857F for ; Tue, 26 Jun 2018 11:57:09 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 0BAF8286C0; Tue, 26 Jun 2018 11:57:09 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8ADFF2857F for ; Tue, 26 Jun 2018 11:57:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934600AbeFZL5D (ORCPT ); Tue, 26 Jun 2018 07:57:03 -0400 Received: from esa1.hgst.iphmx.com ([68.232.141.245]:33875 "EHLO esa1.hgst.iphmx.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934276AbeFZL5B (ORCPT ); Tue, 26 Jun 2018 07:57:01 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=wdc.com; i=@wdc.com; q=dns/txt; s=dkim.wdc.com; t=1530014221; x=1561550221; h=from:to:cc:subject:date:message-id:in-reply-to: references; bh=a58Tu3zaBt7/EC7DHd/gH+o7Xx3UYsQUnmLuUXIe5L8=; b=YUXBDGBWiAdfO+qDNfYWMtVL654RD639FqpKVXAd098fq27eRu0BdQ0J BFVt3Ek1OWjelryLig7PPvscL2DIQtC/FkMf7FDyj3/KqEoLcdg3eSJST lKcKOItN95Snys9vyU2m4xgxnzRUXFACD/SsptgToA/WuciYFu4A6Bg8w Y7iwz7jhphLt0EcGwWUeJ/5bIwaaYUPcFk5cV8odddYEE0tQk34XoUlSp cgci6/Ll5WmEeQRwP4ZxSqUHrYZxXgqmZqRE9WzU80Xthm4mPXwqV2fwK JVh7ihVZITdEuOIqLzUOTY+Ohn708vtegviQKQdf+18kW70yiejeITWzg w==; X-IronPort-AV: E=Sophos;i="5.51,274,1526313600"; d="scan'208";a="185381034" Received: from uls-op-cesaip01.wdc.com (HELO uls-op-cesaep01.wdc.com) ([199.255.45.14]) by ob1.hgst.iphmx.com with ESMTP; 26 Jun 2018 19:57:01 +0800 Received: from uls-op-cesaip01.wdc.com ([10.248.3.36]) by uls-op-cesaep01.wdc.com with ESMTP; 26 Jun 2018 04:46:36 -0700 Received: from washi.fujisawa.hgst.com ([10.149.53.254]) by uls-op-cesaip01.wdc.com with ESMTP; 26 Jun 2018 04:57:01 -0700 From: Damien Le Moal To: Tejun Heo , linux-ide@vger.kernel.org Cc: linux-scsi@vger.kernel.org, "Martin K . Petersen" , Bart Van Assche , Hannes Reinecke , stable@vger.kernel.org Subject: [PATCH V2 1/2] ata: Fix ZBC_OUT command block check Date: Tue, 26 Jun 2018 20:56:54 +0900 Message-Id: <20180626115655.15562-2-damien.lemoal@wdc.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20180626115655.15562-1-damien.lemoal@wdc.com> References: <20180626115655.15562-1-damien.lemoal@wdc.com> Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The block (LBA) specified must not exceed the last addressable LBA, which is dev->nr_sectors - 1. So fix the correct check is "if (block >= dev->n_sectors)" and not "if (block > dev->n_sectords)". Additionally, the asc/ascq to return for an LBA that is not a zone start LBA should be ILLEGAL REQUEST, regardless if the bad LBA is out of range. Reported-by: David Butterfield Signed-off-by: Damien Le Moal Cc: stable@vger.kernel.org --- drivers/ata/libata-scsi.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c index 6a91d04351d9..a5543751f446 100644 --- a/drivers/ata/libata-scsi.c +++ b/drivers/ata/libata-scsi.c @@ -3805,8 +3805,13 @@ static unsigned int ata_scsi_zbc_out_xlat(struct ata_queued_cmd *qc) */ goto invalid_param_len; } - if (block > dev->n_sectors) - goto out_of_range; + if (block >= dev->n_sectors) { + /* + * Block must be a valid zone ID (a zone start LBA). + */ + fp = 2; + goto invalid_fld; + } all = cdb[14] & 0x1; @@ -3837,10 +3842,6 @@ static unsigned int ata_scsi_zbc_out_xlat(struct ata_queued_cmd *qc) invalid_fld: ata_scsi_set_invalid_field(qc->dev, scmd, fp, 0xff); return 1; - out_of_range: - /* "Logical Block Address out of range" */ - ata_scsi_set_sense(qc->dev, scmd, ILLEGAL_REQUEST, 0x21, 0x00); - return 1; invalid_param_len: /* "Parameter list length error" */ ata_scsi_set_sense(qc->dev, scmd, ILLEGAL_REQUEST, 0x1a, 0x0);