Re: [PATCH] ata: libata-scsi: fix ata_scsi_security_inout_xlat() buffer length conversion

[Damien Le Moal <dlemoal@kernel.org>]

On 6/24/26 6:22 PM, Hannes Reinecke wrote:
> On 6/24/26 11:09 AM, Damien Le Moal wrote:
>> ata_scsi_security_inout_xlat() converts the SCSI command buffer length
>> into the ATA sector size based size by aligning upward the length to 512B.
>> That is incorrect as that can lead to specifying a buffer size that is
>> larger than the memory allocated for the command buffer, resulting in all
>> sorts of possible command failures and/or memory corruptions.
>>
>> Ideally, we should bounce the buffer to a large enough size to fit
>> the entire SCSI command buffer, but we do not have anything in place to do
>> that cleanly. So for now, fix this by converting the command buffer length
>> downward with a simple division of the buffer length by ATA_SECT_SIZE.
>>
>> Fixes: 818831c8b22f ("libata: implement SECURITY PROTOCOL IN/OUT")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
>> ---
>>   drivers/ata/libata-scsi.c | 8 +++++++-
>>   1 file changed, 7 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
>> index d54ec1631e9a..e78801e7ea8c 100644
>> --- a/drivers/ata/libata-scsi.c
>> +++ b/drivers/ata/libata-scsi.c
>> @@ -4330,7 +4330,13 @@ static unsigned int
>> ata_scsi_security_inout_xlat(struct ata_queued_cmd *qc)
>>           }
>>             /* convert to the sector-based ATA addressing */
>> -        len = (len + 511) / 512;
>> +        if (len) {
>> +            len = len / ATA_SECT_SIZE;
>> +            if (!len) {
>> +                ata_scsi_set_invalid_field(qc->dev, scmd, 6, 0);
>> +                return 1;
>> +            }
>> +        }
>>       }
>>         tf->protocol = dma ? ATA_PROT_DMA : ATA_PROT_PIO;
> 
> round_down(), maybe?
> To make the intention clear?

Nope. We do not want a number of bytes but a number of ATA 512B sector count :)

> 
> Cheers,
> 
> Hannes


-- 
Damien Le Moal
Western Digital Research