Re: PATCH libata-2.6 4/5] Prevent the device from overrunning the buffer in __atapi_pio_bytes()

[Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>]

On Fri, 18 Mar 2005 16:00:36 +0800, Albert Lee <albertcc@tw.ibm.com> wrote:
> Hi Jeff,
> 
> Problem:
>    Some bad behaved CD-ROM drives will return more data than ask to.
> (I have such CD-RW drive and it crashed the kernel.)

These devices are compliant with original ATAPI spec.

Such condition shouldn't be treated as an error
- extra data should be read and dumped.

> Changes:
> - Add additional check in __atapi_pio_bytes() to prevent the device from overrunning the buffer.
> 
> Attached please find the patch against the libata-2.6 tree for your review. Thanks.
> 
> Albert
> 
> Signed-off-by: Albert Lee <albertcc@tw.ibm.com>
> ---------------------------------------
> --- libata-2.6-reorder/drivers/scsi/libata-core.c       2005-03-18 12:56:44.000000000 +0800
> +++ libata-2.6-extrabytes/drivers/scsi/libata-core.c    2005-03-18 14:00:34.000000000 +0800
> @@ -2338,6 +2338,14 @@
>                 ap->pio_task_state = PIO_ST_LAST;
> 
>   next_sg:
> +       /* check whether qc->sg is full */
> +       if (unlikely(qc->cursg >= qc->n_elem)) {
> +               printk(KERN_WARNING "ata%u: qc->sg full, %u bytes trailing\n", ap->id, bytes);
> +
> +               ap->pio_task_state = PIO_ST_ERR;
> +               return;
> +       }
> +
>         sg = &qc->sg[qc->cursg];
> 
>         page = sg->page;
> 
> 
> --- libata-2.6-reorder/drivers/scsi/libata-core.c       2005-03-18 12:56:44.000000000 +0800
> +++ libata-2.6-extrabytes/drivers/scsi/libata-core.c    2005-03-18 14:00:34.000000000 +0800
> @@ -2338,6 +2338,14 @@
>                 ap->pio_task_state = PIO_ST_LAST;
> 
>  next_sg:
> +       /* check whether qc->sg is full */
> +       if (unlikely(qc->cursg >= qc->n_elem)) {
> +               printk(KERN_WARNING "ata%u: qc->sg full, %u bytes trailing\n", ap->id, bytes);
> +
> +               ap->pio_task_state = PIO_ST_ERR;
> +               return;
> +       }
> +
>         sg = &qc->sg[qc->cursg];
> 
>         page = sg->page;
> 
> 
>