[PATCH v3 6/6] scsi: scsi_debug: Validate zone access for WRITE ATOMIC (16)

[Niklas Cassel <cassel@kernel.org>]

WRITE ATOMIC (16) is a write command, so on a zoned device it is subject
to the access requirements of the zone that it addresses, and it advances
the write pointer of a sequential write required zone. See ZBC-3 r06
(T10/BSR INCITS 579), 4.5.3.3.2 Write access pattern requirements for
sequential write required zones.

resp_atomic_write() calls do_device_access() directly, without calling
check_device_access_params() first and without advancing the write
pointer afterwards. It is the only command that writes user data which
does not; WRITE, WRITE SCATTERED and WRITE SAME all go through
check_device_access_params(), which validates zone access for a zoned
device.

As a consequence, with zbc=managed atomic_wr=1, a WRITE ATOMIC (16) can
write anywhere within a sequential write required zone regardless of its
write pointer and zone condition, into a gap zone, or across a zone
boundary, and none of it is reflected in the zone state. The write
pointer is left where it was, so a subsequent REPORT ZONES does not
describe the data on the medium, and the next write at that write
pointer overwrites data that was written without error.

Validate the access and advance the write pointer the way
resp_write_dt0() does. The zone metadata write lock is already taken
across the access for the provisioning map; take it for a zoned device
too, as the write pointer has to be read and updated atomically with
respect to other commands. Unlike an ordinary write, the write pointer
is advanced only when all of the data was written, as an atomic write
either completes or has no effect.

Assisted-by: LLM
Fixes: 84f3a3c01d70 ("scsi: scsi_debug: Atomic write support")
Signed-off-by: Niklas Cassel <cassel@kernel.org>
---
 drivers/scsi/scsi_debug.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 33f2df26e5af..b57d25d7214c 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -6229,15 +6229,29 @@ static int resp_atomic_write(struct scsi_cmnd *scp,
 		}
 	}
 
-	if (scsi_debug_lbp()) {
+	if (sdebug_dev_is_zoned(devip) || scsi_debug_lbp()) {
 		sdeb_meta_write_lock(sip);
 		meta_data_locked = true;
 	}
 
+	ret = check_device_access_params(scp, lba, len, true);
+	if (ret) {
+		if (meta_data_locked)
+			sdeb_meta_write_unlock(sip);
+		return ret;
+	}
+
 	ret = do_device_access(sip, scp, 0, lba, len, 0, true, true);
 	if (unlikely(scsi_debug_lbp()))
 		map_region(sip, lba, len);
 
+	/*
+	 * If ZBC zone then bump its write pointer, but only if all of the data
+	 * was written: an atomic write either completes or has no effect.
+	 */
+	if (sdebug_dev_is_zoned(devip) && ret == len * sdebug_sector_size)
+		zbc_inc_wp(devip, lba, len);
+
 	if (meta_data_locked)
 		sdeb_meta_write_unlock(sip);
 
-- 
2.55.0