[PATCH] scsi: Improves scsi_vpd_inquiry() checks

[PATCH] scsi: Improves scsi_vpd_inquiry() checks

[Damien Le Moal]

Some USB-SATA adapters have a broken behavior when a non supported VPD
page is probed: depending on the VPD page number, a 4 byte header with a
valid VPD page number but with a 0 lenghth is returned. Currently,
scsi_vpd_inquiry() only checks that the page number is valid to
determine if the page is supported, which results in VPD page users
receiving only the 4 B header for the non existent page. This error
manifests itself very often with page 0xb9 for the concurrent
Positioning Ranges detection done by sd_read_cpr(), resulting in the
error message:

sd 0:0:0:0: [sda] Invalid Concurrent Positioning Ranges VPD page

Prevent such misleading error message by adding a check in
scsi_vpd_inquiry() to verify that the page length is not 0.

Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
---
 drivers/scsi/scsi.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index ab6e2d5e1430..c4bf99a842f3 100644
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -314,11 +314,18 @@ static int scsi_vpd_inquiry(struct scsi_device *sdev, unsigned char *buffer,
 	if (result)
 		return -EIO;
 
-	/* Sanity check that we got the page back that we asked for */
+	/*
+	 * Sanity check that we got the page back that we asked for and that
+	 * the page size is not 0.
+	 */
 	if (buffer[1] != page)
 		return -EIO;
 
-	return get_unaligned_be16(&buffer[2]) + 4;
+	result = get_unaligned_be16(&buffer[2]);
+	if (!result)
+		return -EIO;
+
+	return result + 4;
 }
 
 static int scsi_get_vpd_size(struct scsi_device *sdev, u8 page)
-- 
2.39.2

Re: [PATCH] scsi: Improves scsi_vpd_inquiry() checks

[Benjamin Block]

On Wed, Mar 22, 2023 at 11:22:11AM +0900, Damien Le Moal wrote:
> Some USB-SATA adapters have a broken behavior when a non supported VPD
> page is probed: depending on the VPD page number, a 4 byte header with a
> valid VPD page number but with a 0 lenghth is returned. Currently,
> scsi_vpd_inquiry() only checks that the page number is valid to
> determine if the page is supported, which results in VPD page users
> receiving only the 4 B header for the non existent page. This error
> manifests itself very often with page 0xb9 for the concurrent
> Positioning Ranges detection done by sd_read_cpr(), resulting in the
> error message:
> 
> sd 0:0:0:0: [sda] Invalid Concurrent Positioning Ranges VPD page
> 
> Prevent such misleading error message by adding a check in
> scsi_vpd_inquiry() to verify that the page length is not 0.
> 
> Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
> ---
>  drivers/scsi/scsi.c | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
> 

Looks good to me.


Reviewed-by: Benjamin Block <bblock@linux.ibm.com>

-- 
Best Regards, Benjamin Block        /        Linux on IBM Z Kernel Development
IBM Deutschland Research & Development GmbH    /   https://www.ibm.com/privacy
Vors. Aufs.-R.: Gregor Pillen         /         Geschäftsführung: David Faller
Sitz der Ges.: Böblingen     /    Registergericht: AmtsG Stuttgart, HRB 243294

Re: [PATCH] scsi: Improves scsi_vpd_inquiry() checks

[Martin K. Petersen]

Damien,

> Some USB-SATA adapters have a broken behavior when a non supported VPD
> page is probed: depending on the VPD page number, a 4 byte header with a
> valid VPD page number but with a 0 lenghth is returned. Currently,
> scsi_vpd_inquiry() only checks that the page number is valid to
> determine if the page is supported, which results in VPD page users
> receiving only the 4 B header for the non existent page. This error
> manifests itself very often with page 0xb9 for the concurrent
> Positioning Ranges detection done by sd_read_cpr(), resulting in the
> error message:

Applied to 6.3/scsi-fixes, thanks!

[1/1] scsi: core: Improve scsi_vpd_inquiry() checks
      https://git.kernel.org/mkp/scsi/c/f0aa59a33d2a

-- 
Martin K. Petersen	Oracle Linux Engineering