Re: out-of-bounds write in the function ata_pio_sector

Martin K. Petersen
2025-01-29T03:09:55Z

Niklas,

Sorry about the delay, was out for a few days.

> I was kind of expecting some upper layer, SCSI or block, to have rejected
> an operation that is not a multiple of the sector size.
>
> Is that a silly assumption?

Not all SCSI commands operate on logical blocks. Plus even if they do
the actual data transfer could still be larger than one block due to PI
or long writes.

That's all a bit theoretical in the context of the archaic
sg_scsi_ioctl() call since that only takes a single page and has little
practical use. But in general we can't assume that everything is a
multiple of 512 bytes.

Your fix looks OK to me.

--
Martin K. Petersen Oracle Linux Engineering