From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794272530; b=cRyC2nxm9dKGJ8Klk1E5Yr40dqbUlkbokAhXdjxd1Xvw7hfcxuvn/p4ThZzBUTNn6H5Q cS9gzKXUiG6UyNxlTPR3V7OkV5NRc3zkNI5FsYyKGhU46n9ioa18QY/iMCtSSRdmQPcuF 8OEHy+/uKBuiVqAujAZYUAOentVJ32o4cE0YBgTj1U5Ltp0b9+mDJIccR35O7zbKMRYcp iDVvF7I0PeWhpRfH/a4V7hx9c9jpTqtVn0+OWCrZ6ARjJqLQ/9iyjsQVdGsyJEaDNFQC/ bGc3NEA576n9vb88mBeluSxX764yVdm+ZdJ6nSB/HWWNL8du0o/ytsHPFbdFuQJSXPg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794272530; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: MIME-Version:Content-Type:Content-Transfer-Encoding; bh=bO2TWl0D2PjDaJ1FkmotcrNxRUurZjRND/UOQQGb9Yk=; b=apxI9K1Q7wy+vdq+bBUeU4fNxrznMkTsz2JX9I8X3yHHnerjBazf0E/Am6fI6tcHjnFN 8iQ++4zwbP/DomvgUFZ0miSPmvj1ofuupHQkTM7Mi9O2z9TCElBAWiUtNd+KwdF1Z2aUr xLKMfPN0kLZZRnLvEY7Jayg/nnXC0FLL4hkUUFTJYpbOxGvmSQHm+Kkd+1z3Py3Bszrmi vraoHMN1n6aJRSDgfgT2If6ZKVV+MvewtU2NChKWUegKyPX1WzU6kMOQDcnyPA8LjziC5 muK2eQd+cgRSqdxlGXuo8YDb+fXp/FfJ9fOoMoPlNTYWDK6uLeQ4D1EVJReXdAW9fqw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=QNZcdOiS; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4C5EE606A31C for ; Tue, 10 Nov 2026 01:02:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=QNZcdOiS Received: by smtp.kernel.org (Postfix) with ESMTPSA id 93C681F0089F; Tue, 10 Nov 2026 01:02:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1794272530; bh=bO2TWl0D2PjDaJ1FkmotcrNxRUurZjRND/UOQQGb9Yk=; h=From:To:Cc:Subject:Date; b=QNZcdOiSfx5WGaZ/yE67Rx8kkVf6Lq14HFmlYy4zRJ1byvP1U7mRzuNwQ7lTi/yhF A3NeRSvSRMfUfmAAlsgTg7gzqy6tssFgxbKIaMzGHmpfB1zD/d4rl/tj3S+7xG4xvw u+MKoIxqctpvBqjXGMXrU5JW7qPpJBn8uucRdJaKnIYIOaOTzjfUEBBUzDfnft30+X hsOLFUal3TM4dumxLrlMhhdedfJB53hFGsYGO6c0dh0T9Kl83VWnyXt76Mir79V5w9 MqB5z8n4yY7BzRybfY8ya7DqcRWqJM0QRHsEE4HKA7QQ9+Gpa/wbH7vDF8jU4fTbYn tb0llPQueKiyA== From: Sasha Levin To: zhaogongyi@bytedance.com, cassel@kernel.org, dlemoal@kernel.org Cc: stable@vger.kernel.org Subject: FAILED: patch "[PATCH] ata: libata-scsi: reject data-in commands with a data-out buffer" failed to apply to 7.3-stable tree Date: Mon, 9 Nov 2026 20:02:08 -0500 Message-ID: <20261109200208-failed-7.3-a4845f077415@kernel.org> X-Mailer: git-send-email 2.53.0 X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The patch below does not apply to the 7.3-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-7.3.y git checkout FETCH_HEAD git cherry-pick -x a4845f077415ef32fe672c841e2fc58ae9e28273 # git commit -s git send-email --to '' --in-reply-to '20261109200208-failed-7.3-a4845f077415@kernel.org' --subject-prefix 'PATCH 7.3.y' 'HEAD^..' Thanks, Sasha ------------------ original commit in Linus's tree ------------------ >From a4845f077415ef32fe672c841e2fc58ae9e28273 Mon Sep 17 00:00:00 2001 From: Zhao Gongyi Date: Wed, 4 Nov 2026 21:06:38 +0800 Subject: [PATCH] ata: libata-scsi: reject data-in commands with a data-out buffer SG_IO can submit a data-in SCSI command with DMA_TO_DEVICE. The scatterlist can then contain pages pinned without write access. ata_scsi_rbuf_fill() writes simulated replies to that scatterlist; in the reported case, the copy tried to write the shared zero page and faulted in the kernel. The same mismatch can affect SG_IO commands translated by libata. ZBC IN and GET PHYSICAL ELEMENT STATUS completion handlers can modify the receive buffer even if the drive aborts the command. For ATAPI, the successful INQUIRY completion also rewrites the buffer in atapi_fixup_inquiry(). Reject these mismatched commands before the buffer is written or the command is issued. Report ABORTED COMMAND / DATA IN BUFFER ERROR because the CDB itself can be valid; the supplied transfer direction is wrong. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Link: https://lore.kernel.org/r/20261027090809.94126-1-zhaogongyi@bytedance.com Suggested-by: Niklas Cassel Suggested-by: Damien Le Moal Cc: stable@vger.kernel.org Signed-off-by: Zhao Gongyi Reviewed-by: Damien Le Moal Link: https://lore.kernel.org/r/20261104130638.37882-1-zhaogongyi@bytedance.com Signed-off-by: Niklas Cassel --- drivers/ata/libata-scsi.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c index b1d5d822a9a20..87a57495d2e4b 100644 --- a/drivers/ata/libata-scsi.c +++ b/drivers/ata/libata-scsi.c @@ -2048,6 +2048,19 @@ static int ata_scsi_translate(struct ata_device *dev, struct scsi_cmnd *cmd, if (xlat_func(qc)) goto done; + /* + * A data-out request may contain pages pinned without write access. + * Reject a translated data-in command before issuing it, since its + * completion handler may write to the buffer even if the device fails. + */ + if (unlikely(cmd->sc_data_direction == DMA_TO_DEVICE && + ata_is_data(qc->tf.protocol) && + !(qc->tf.flags & ATA_TFLAG_WRITE))) { + ata_scsi_set_sense(dev, cmd, ABORTED_COMMAND, + DATA_IN_BUFFER_ERROR); + goto done; + } + return ata_scsi_qc_issue(ap, qc); done: @@ -2079,6 +2092,13 @@ static void ata_scsi_rbuf_fill(struct ata_device *dev, struct scsi_cmnd *cmd, unsigned long flags; unsigned int len; + /* A data-out request may contain pages pinned without write access. */ + if (cmd->sc_data_direction == DMA_TO_DEVICE) { + ata_scsi_set_sense(dev, cmd, ABORTED_COMMAND, + DATA_IN_BUFFER_ERROR); + return; + } + spin_lock_irqsave(&ata_scsi_rbuf_lock, flags); memset(ata_scsi_rbuf, 0, ATA_SCSI_RBUF_SIZE); @@ -3173,6 +3193,14 @@ static unsigned int atapi_xlat(struct ata_queued_cmd *qc) qc->complete_fn = atapi_qc_complete; + /* atapi_fixup_inquiry() writes to the buffer on successful completion. */ + if (scmd->sc_data_direction == DMA_TO_DEVICE && + scmd->cmnd[0] == INQUIRY) { + ata_scsi_set_sense(dev, scmd, ABORTED_COMMAND, + DATA_IN_BUFFER_ERROR); + return 1; + } + qc->tf.flags |= ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE; if (scmd->sc_data_direction == DMA_TO_DEVICE) { qc->tf.flags |= ATA_TFLAG_WRITE; -- 2.53.0