Re: [PATCH 5.10.y 1/3] scsi: core: Fix scsi_mode_sense() buffer length handling

[Sasha Levin <sashal@kernel.org>]

[ Sasha's backport helper bot ]

Hi,

The upstream commit SHA1 provided is correct: 17b49bcbf8351d3dbe57204468ac34f033ed60bc

WARNING: Author mismatch between patch and upstream commit:
Backport author: Vasiliy Kovalev <kovalev@altlinux.org>
Commit author: Damien Le Moal <damien.lemoal@wdc.com>


Status in newer kernel trees:
6.12.y | Present (exact SHA1)
6.6.y | Present (exact SHA1)
6.1.y | Present (exact SHA1)
5.15.y | Present (different SHA1: e15de347faf4)
5.10.y | Not found

Note: The patch differs from the upstream commit:
---
1:  17b49bcbf8351 ! 1:  5e9ba35e00eb9 scsi: core: Fix scsi_mode_sense() buffer length handling
    @@ Metadata
      ## Commit message ##
         scsi: core: Fix scsi_mode_sense() buffer length handling
     
    +    commit 17b49bcbf8351d3dbe57204468ac34f033ed60bc upstream.
    +
         Several problems exist with scsi_mode_sense() buffer length handling:
     
          1) The allocation length field of the MODE SENSE(10) command is 16-bits,
    @@ Commit message
         Link: https://lore.kernel.org/r/20210820070255.682775-2-damien.lemoal@wdc.com
         Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
         Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    +    Signed-off-by: Vasiliy Kovalev <kovalev@altlinux.org>
     
      ## drivers/scsi/scsi_lib.c ##
     @@ drivers/scsi/scsi_lib.c: EXPORT_SYMBOL_GPL(scsi_mode_select);
    @@ drivers/scsi/scsi_lib.c: scsi_mode_sense(struct scsi_device *sdev, int dbd, int
     +				 * too large for MODE SENSE single byte
     +				 * allocation length field.
      				 */
    - 				if (use_10_for_ms) {
    -+					if (len > 255)
    -+						return -EIO;
    - 					sdev->use_10_for_ms = 0;
    - 					goto retry;
    - 				}
    ++				if (len > 255)
    ++					return -EIO;
    + 				sdev->use_10_for_ms = 0;
    + 				goto retry;
    + 			}
     @@ drivers/scsi/scsi_lib.c: scsi_mode_sense(struct scsi_device *sdev, int dbd, int modepage,
    - 		data->longlba = 0;
    - 		data->block_descriptor_length = 0;
    - 	} else if (use_10_for_ms) {
    --		data->length = buffer[0]*256 + buffer[1] + 2;
    -+		data->length = get_unaligned_be16(&buffer[0]) + 2;
    - 		data->medium_type = buffer[2];
    - 		data->device_specific = buffer[3];
    - 		data->longlba = buffer[4] & 0x01;
    --		data->block_descriptor_length = buffer[6]*256
    --			+ buffer[7];
    -+		data->block_descriptor_length = get_unaligned_be16(&buffer[6]);
    - 	} else {
    - 		data->length = buffer[0] + 1;
    - 		data->medium_type = buffer[1];
    + 			data->longlba = 0;
    + 			data->block_descriptor_length = 0;
    + 		} else if (use_10_for_ms) {
    +-			data->length = buffer[0]*256 + buffer[1] + 2;
    ++			data->length = get_unaligned_be16(&buffer[0]) + 2;
    + 			data->medium_type = buffer[2];
    + 			data->device_specific = buffer[3];
    + 			data->longlba = buffer[4] & 0x01;
    +-			data->block_descriptor_length = buffer[6]*256
    +-				+ buffer[7];
    ++			data->block_descriptor_length = get_unaligned_be16(&buffer[6]);
    + 		} else {
    + 			data->length = buffer[0] + 1;
    + 			data->medium_type = buffer[1];
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-5.10.y       |  Success    |  Success   |