From: Damien Le Moal <dlemoal@kernel.org>
To: Karuna Ramkumar <rkaruna@google.com>
Cc: sashiko-reviews@lists.linux.dev, cassel@kernel.org,
linux-ide@vger.kernel.org, Igor Pylypiv <ipylypiv@google.com>,
TJ Adams <tadamsjr@google.com>
Subject: Re: [PATCH v2] ata: libata-scsi: limit simulated SCSI command copy to response length
Date: Thu, 9 Jul 2026 14:45:55 +0900 [thread overview]
Message-ID: <9381e503-6668-4afa-a514-a1926d790046@kernel.org> (raw)
In-Reply-To: <CAD50Xqra-_2CnJdGPJtWeOZT-Ne4wRRcQEL+6uy1--jPRYwACQ@mail.gmail.com>
On 7/9/26 12:34, Karuna Ramkumar wrote:
> Hi Damien,
>
> I went through all the SCSI actor functions in libata-scsi.c and
> calculated their maximum size consumption.
>
> As you mentioned, most command emulations triggered via actor
> callbacks write a fixed or small amount of payload, and are well
> within the 2048 byte limit of `ata_scsi_rbuf`.
>
> There are two functions that can potentially overflow though:
>
> 1. ata_scsiop_inq_b9: Writes 64 + nr_cpr * 32 bytes. If nr_cpr crosses
> 62, then this can cause an overflow
> 2. ata_format_dsm_trim_descr: Writes trmax * 8 bytes. If trmax > 2048
> / 8, then this can cause an overflow too.
>
> I will prepare a patch to add bounds checks to these two functions and
> send it over for review. Please let me know if you have any
> suggestions/concerns.
Sounds good. Thanks.
--
Damien Le Moal
Western Digital Research
next prev parent reply other threads:[~2026-07-09 5:45 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-02 2:01 [PATCH v2] ata: libata-scsi: limit simulated SCSI command copy to response length Karuna Ramkumar
2026-07-02 2:14 ` sashiko-bot
2026-07-02 2:30 ` Damien Le Moal
2026-07-06 23:10 ` Karuna Ramkumar
2026-07-07 1:10 ` Damien Le Moal
2026-07-09 3:34 ` Karuna Ramkumar
2026-07-09 5:45 ` Damien Le Moal [this message]
2026-07-09 13:11 ` Niklas Cassel
2026-07-03 6:17 ` Damien Le Moal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=9381e503-6668-4afa-a514-a1926d790046@kernel.org \
--to=dlemoal@kernel.org \
--cc=cassel@kernel.org \
--cc=ipylypiv@google.com \
--cc=linux-ide@vger.kernel.org \
--cc=rkaruna@google.com \
--cc=sashiko-reviews@lists.linux.dev \
--cc=tadamsjr@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.