| Message ID | 20230322022211.116327-1-damien.lemoal@opensource.wdc.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | f0aa59a33d2ac2267d260fe21eaf92500df8e7b4 |
| Headers | show |
| Series | scsi: Improves scsi_vpd_inquiry() checks | expand |
On Wed, Mar 22, 2023 at 11:22:11AM +0900, Damien Le Moal wrote: > Some USB-SATA adapters have a broken behavior when a non supported VPD > page is probed: depending on the VPD page number, a 4 byte header with a > valid VPD page number but with a 0 lenghth is returned. Currently, > scsi_vpd_inquiry() only checks that the page number is valid to > determine if the page is supported, which results in VPD page users > receiving only the 4 B header for the non existent page. This error > manifests itself very often with page 0xb9 for the concurrent > Positioning Ranges detection done by sd_read_cpr(), resulting in the > error message: > > sd 0:0:0:0: [sda] Invalid Concurrent Positioning Ranges VPD page > > Prevent such misleading error message by adding a check in > scsi_vpd_inquiry() to verify that the page length is not 0. > > Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com> > --- > drivers/scsi/scsi.c | 11 +++++++++-- > 1 file changed, 9 insertions(+), 2 deletions(-) > Looks good to me. Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Damien, > Some USB-SATA adapters have a broken behavior when a non supported VPD > page is probed: depending on the VPD page number, a 4 byte header with a > valid VPD page number but with a 0 lenghth is returned. Currently, > scsi_vpd_inquiry() only checks that the page number is valid to > determine if the page is supported, which results in VPD page users > receiving only the 4 B header for the non existent page. This error > manifests itself very often with page 0xb9 for the concurrent > Positioning Ranges detection done by sd_read_cpr(), resulting in the > error message: Applied to 6.3/scsi-fixes, thanks! [1/1] scsi: core: Improve scsi_vpd_inquiry() checks https://git.kernel.org/mkp/scsi/c/f0aa59a33d2a
diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c index ab6e2d5e1430..c4bf99a842f3 100644 --- a/drivers/scsi/scsi.c +++ b/drivers/scsi/scsi.c @@ -314,11 +314,18 @@ static int scsi_vpd_inquiry(struct scsi_device *sdev, unsigned char *buffer, if (result) return -EIO; - /* Sanity check that we got the page back that we asked for */ + /* + * Sanity check that we got the page back that we asked for and that + * the page size is not 0. + */ if (buffer[1] != page) return -EIO; - return get_unaligned_be16(&buffer[2]) + 4; + result = get_unaligned_be16(&buffer[2]); + if (!result) + return -EIO; + + return result + 4; } static int scsi_get_vpd_size(struct scsi_device *sdev, u8 page)
Some USB-SATA adapters have a broken behavior when a non supported VPD page is probed: depending on the VPD page number, a 4 byte header with a valid VPD page number but with a 0 lenghth is returned. Currently, scsi_vpd_inquiry() only checks that the page number is valid to determine if the page is supported, which results in VPD page users receiving only the 4 B header for the non existent page. This error manifests itself very often with page 0xb9 for the concurrent Positioning Ranges detection done by sd_read_cpr(), resulting in the error message: sd 0:0:0:0: [sda] Invalid Concurrent Positioning Ranges VPD page Prevent such misleading error message by adding a check in scsi_vpd_inquiry() to verify that the page length is not 0. Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com> --- drivers/scsi/scsi.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)