| Message ID | 578eaead.0198620a.7cf53.28c1@mx.google.com (mailing list archive) |
|---|---|
| State | Rejected, archived |
| Headers | show |
Oops I put the wrong action under the opposite condition. Sending a v2. On 20 July 2016 at 06:50, <tom.ty89@gmail.com> wrote: > From: Tom Yan <tom.ty89@gmail.com> > > Commit 7780081c1f04 ("libata-scsi: Set information sense field for > invalid parameter") changed how ata_mselect_*() make sure read-only > bits are not modified. The new implementation introduced a bug that > the read-only bits in the byte that has a changeable bit will not > be checked. > > Added the necessary check, with comments explaining the heuristic. > > Signed-off-by: Tom Yan <tom.ty89@gmail.com> > > diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c > index 06afe63..005d186 100644 > --- a/drivers/ata/libata-scsi.c > +++ b/drivers/ata/libata-scsi.c > @@ -3617,8 +3617,18 @@ static int ata_mselect_caching(struct ata_queued_cmd *qc, > */ > ata_msense_caching(dev->id, mpage, false); > for (i = 0; i < CACHE_MPAGE_LEN - 2; i++) { > - if (i == 0) > - continue; > + /* Check the first byte */ > + if (i == 0) { > + /* except the WCE bit */ > + if (mpage[i + 2] & 0xfb != buf[i] & 0xfb) { > + continue; > + } else { > + *fp = i; > + return -EINVAL; > + } > + } > + > + /* Check the remaining bytes */ > if (mpage[i + 2] != buf[i]) { > *fp = i; > return -EINVAL; > @@ -3672,8 +3682,18 @@ static int ata_mselect_control(struct ata_queued_cmd *qc, > */ > ata_msense_control(dev, mpage, false); > for (i = 0; i < CONTROL_MPAGE_LEN - 2; i++) { > - if (i == 0) > - continue; > + /* Check the first byte */ > + if (i == 0) { > + /* except the D_SENSE bit */ > + if (mpage[i + 2] & 0xfb != buf[i] & 0xfb) { > + continue; > + } else { > + *fp = i; > + return -EINVAL; > + } > + } > + > + /* Check the remaining bytes */ > if (mpage[2 + i] != buf[i]) { > *fp = i; > return -EINVAL; > -- > 2.9.0 > -- To unsubscribe from this list: send the line "unsubscribe linux-scsi" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c index 06afe63..005d186 100644 --- a/drivers/ata/libata-scsi.c +++ b/drivers/ata/libata-scsi.c @@ -3617,8 +3617,18 @@ static int ata_mselect_caching(struct ata_queued_cmd *qc, */ ata_msense_caching(dev->id, mpage, false); for (i = 0; i < CACHE_MPAGE_LEN - 2; i++) { - if (i == 0) - continue; + /* Check the first byte */ + if (i == 0) { + /* except the WCE bit */ + if (mpage[i + 2] & 0xfb != buf[i] & 0xfb) { + continue; + } else { + *fp = i; + return -EINVAL; + } + } + + /* Check the remaining bytes */ if (mpage[i + 2] != buf[i]) { *fp = i; return -EINVAL; @@ -3672,8 +3682,18 @@ static int ata_mselect_control(struct ata_queued_cmd *qc, */ ata_msense_control(dev, mpage, false); for (i = 0; i < CONTROL_MPAGE_LEN - 2; i++) { - if (i == 0) - continue; + /* Check the first byte */ + if (i == 0) { + /* except the D_SENSE bit */ + if (mpage[i + 2] & 0xfb != buf[i] & 0xfb) { + continue; + } else { + *fp = i; + return -EINVAL; + } + } + + /* Check the remaining bytes */ if (mpage[2 + i] != buf[i]) { *fp = i; return -EINVAL;