From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 46102342532; Sat, 17 Oct 2026 16:05:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792253117; cv=none; b=kCE4LX7AReXz8AEcfPqbAb1l0UeF+6nznYCd7U6kdo9IbH7NluW96EDpN3ce2LWkAQewyjusGwR8xAIocpn52kkOqld94NEkNy4i4yrEVK2epT9WZv/gv/dASmaV50BThxbvSR654hb+ZOU7nt+hVL63DUZTK7mCEjdBgL+BG6E= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792253117; c=relaxed/simple; bh=UI/1fSaZTwa/iFPeM2xmZYXkKlmnWjrmelWkC79lKEY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ePuPBRiokA0c1S3/thV53b6G/sn/n4qcOn2RCu1cB80CLoDW5Pcd/yyZ7h1Ldl4yARZX1Nl4g2ezBiaqDL8uQJHUO3oS+PrLG0djAb0o8IP+JXPN+BV+/us5+jPKOVjXmZ9qwz7qkYotsCouLMGxt0qP2aupWN8YAbLtpd7vzBc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=nZf1BC7+; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="nZf1BC7+" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 93AB11F000C4; Sat, 17 Oct 2026 16:05:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1792253116; bh=dNEZqfk6vvmOWoxRHa3ox1tBPQEupdi8NxDbWe5dws8=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=nZf1BC7+/E52vXHT/buP5/KqIZ9rYaW3I76BHl3Un6Pb2Mz/AgPhMi+3PVjT1xUNr k06ENjgqRFw/T904p7bIYv7hx2CjwWs6P2LjwfTp70cXp6NFTEWnbeza338UzfN06m e78+wp3AYGnSiXkkyANEH/nd1NDwJTCKOIA4RekY= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Niklas Cassel , Hengyu Liang , Damien Le Moal , Sasha Levin Subject: [PATCH 6.12 016/869] ata: libata-scsi: do not lose CHECK CONDITION for failed ATAPI commands Date: Sat, 17 Oct 2026 17:47:37 +0200 Message-ID: <20261017160037.426110443@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261017160036.979869304@linuxfoundation.org> References: <20261017160036.979869304@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Hengyu Liang [ Upstream commit bc8ce2cea5f77c4bd1a5184705e300e83546c0c4 ] Since commit 2e1d2e65e773 ("ata: libata-scsi: terminate deferred commands on time out"), atapi_qc_complete() sets SAM_STAT_CHECK_CONDITION for a failed command only if cmd->result is zero, so that the DID_TIME_OUT or DID_REQUEUE host byte of a terminated command is preserved. However, cmd->result can also be non-zero for a regular failed ATAPI command completed through libata EH: ata_eh_analyze_tf() calls ata_eh_decide_disposition(), that is, scsi_check_sense(), on the sense data obtained with REQUEST SENSE, and scsi_check_sense() sets the SCSI midlayer internal byte of the result for some sense codes, e.g. SCSIML_STAT_TGT_FAILURE for ILLEGAL REQUEST with ASC 0x20 (INVALID COMMAND OPERATION CODE) or 0x24 (INVALID FIELD IN CDB), or SCSIML_STAT_MED_ERROR for MEDIUM ERROR with ASC 0x11 (UNRECOVERED READ ERROR). For such commands, atapi_qc_complete() keeps the result as is and the command completes with a GOOD status byte, even though it failed and valid sense data is available. As a result, passthrough users see these failed ATAPI commands as successful. For example, with the emulated IDE CD-ROM drive of QEMU and no medium loaded, a PLAY AUDIO MSF command issued with SG_IO completes with status 0x00 (and no DRIVER_SENSE) instead of 0x02 (CHECK CONDITION) with sense key ILLEGAL REQUEST, ASC/ASCQ 0x20/0x00, and the CDROM ioctls CDROMPLAYTRKIND, CDROMSUBCHNL, CDROMPAUSE, CDROMRESUME, CDROMPLAYMSF and CDROM_GET_MCN return 0 instead of -ENOMEDIUM or -EOPNOTSUPP. Fix this by setting the status byte to SAM_STAT_CHECK_CONDITION whenever the host byte is not set. Use set_status_byte() rather than overwriting the whole result, so that the SCSI midlayer internal byte set by scsi_check_sense() is preserved, as ata_scsi_qc_complete() already does for ATA commands. Fixes: 2e1d2e65e773 ("ata: libata-scsi: terminate deferred commands on time out") Cc: stable@vger.kernel.org Suggested-by: Niklas Cassel Signed-off-by: Hengyu Liang Reviewed-by: Damien Le Moal Link: https://lore.kernel.org/r/20260929164135.266708-1-hengyul@cs.unc.edu Signed-off-by: Niklas Cassel [ sashal: adapted completion handling to use ata_qc_done() with an immediate return ] Signed-off-by: Sasha Levin --- drivers/ata/libata-scsi.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c index d2777255129c5..d4f6d82fd9085 100644 --- a/drivers/ata/libata-scsi.c +++ b/drivers/ata/libata-scsi.c @@ -3030,8 +3030,14 @@ static void atapi_qc_complete(struct ata_queued_cmd *qc) if (qc->cdb[0] == ALLOW_MEDIUM_REMOVAL && qc->dev->sdev) qc->dev->sdev->locked = 0; - if (!cmd->result) - cmd->result = SAM_STAT_CHECK_CONDITION; + /* + * Report CHECK CONDITION unless the command was terminated + * with a host byte set. Only set the status byte, so that the + * SCSI midlayer internal byte, which scsi_check_sense() may + * have set from the sense data, is preserved. + */ + if (get_host_byte(cmd) == DID_OK) + set_status_byte(cmd, SAM_STAT_CHECK_CONDITION); ata_qc_done(qc); return; } -- 2.53.0