[PATCH 0/2] scsi: scsi_debug: fix zoned write validation

[Niklas Cassel <cassel@kernel.org>]

scsi_debug does not enforce all of the requirements that ZBC places on a
write to a sequential write required zone, and one command bypasses the
zone checks altogether. Both let the emulation accept a write that a
conforming device would terminate, and leave the zone in a state that
the kernel cannot work with.

Patch 1 adds the missing check that the ending LBA of a write falls on a
physical block boundary. Without it, a single logical block write at the
write pointer of a sequential zone is accepted on a device whose
physical block size is larger, and leaves a write pointer that is not a
multiple of the zone_write_granularity reported for the device. Nothing
can then write at that position at the granularity the kernel
advertises, and the zone can only be used again after being reset.

Patch 2 makes WRITE ATOMIC (16) go through the same zone validation as
every other write. resp_atomic_write() calls do_device_access()
directly, so an atomic write is accepted anywhere in a sequential zone
regardless of the write pointer, and the write pointer is never
advanced, which leaves REPORT ZONES describing something other than what
is on the medium.

The two are independent, but the order matters slightly: once patch 2
routes atomic writes through check_zbc_access_params(), the check added
by patch 1 applies to them as well.

Neither defect is reachable in a default configuration. Patch 1's check
is a no-op with the default physblk_exp=0, where the physical block size
equals the logical block size, and patch 2's path needs atomic_wr=1,
which defaults to off. That is presumably why both have gone unnoticed.

Tested on a zoned scsi_debug device with 512 byte logical blocks and a
4096 byte physical block:

  modprobe scsi_debug zbc=managed sector_size=512 physblk_exp=3 \
      zone_size_mb=8 dev_size_mb=128 zone_nr_conv=2 atomic_wr=1

Before the series, a one block WRITE(16) at a sequential zone's write
pointer completes with GOOD status and leaves the write pointer at LBA
0x18001, and a WRITE ATOMIC (16) is accepted both at and past the write
pointer without advancing it. After it, all three are terminated with
ILLEGAL REQUEST / UNALIGNED WRITE COMMAND, while an aligned eight block
WRITE ATOMIC (16) at the write pointer advances the write pointer by
eight blocks. Writes to conventional zones are unaffected.

Niklas Cassel (2):
  scsi: scsi_debug: Enforce physical block alignment of zoned writes
  scsi: scsi_debug: Validate zone access for WRITE ATOMIC (16)

 drivers/scsi/scsi_debug.c | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

-- 
2.55.0