Re: [PATCH v3 1/6] scsi: scsi_debug: Report the residual of a write

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] scsi_debug: unsigned underflow in resp_write_scat() residual calculation
--

commit a487bfccdf1b47222ab79a838751982d68882fc7
Author: Niklas Cassel <cassel@kernel.org>
Subject: scsi: scsi_debug: Report the residual of a write

This patch updates the write paths in scsi_debug to report residual
bytes when a buffer provided by the initiator is larger than the logical
blocks consumed. The residual is now reported in resp_write_dt0(),
resp_write_scat(), and resp_atomic_write().

> diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
> index 6941809dfdb75..641dd6f937912 100644
> --- a/drivers/scsi/scsi_debug.c
> +++ b/drivers/scsi/scsi_debug.c
[ ... ]
> @@ -5352,6 +5354,7 @@ static int resp_write_scat(struct scsi_cmnd *scp,
>  		sg_off += num_by;
>  		cum_lb += num;
>  	}
> +	scsi_set_resid(scp, scsi_bufflen(scp) - sg_off);

[Severity: High]
Can this calculation result in an unsigned underflow if the initiator
provides a buffer shorter than what the CDB descriptors request?

In resp_write_scat(), sg_off tracks the data offset. For each LBA range
descriptor, sg_off is unconditionally incremented by num_by, which is the
size requested by the descriptor. This happens even if do_device_access()
copied less data due to hitting the end of the data-out buffer.

If the initiator provides a shorter buffer (scsi_bufflen) than what the
CDB descriptors request, sg_off will eventually exceed the buffer length.
The subtraction here would then underflow to a massive positive number.

The SCSI midlayer uses this residual to compute good_bytes in
scsi_io_completion(). Subtracting a massive residual from the expected
transfer length could cause good_bytes to wrap and become negative, which
might severely confuse the block layer I/O completion logic.

>  	ret = 0;
>  err_out_unlock:
>  	sdeb_meta_write_unlock(sip);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260917125445.1376493-8-cassel@kernel.org?part=1