From patchwork Tue Jul 19 22:50:14 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tom Yan X-Patchwork-Id: 9238397 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 26B1C600CB for ; Tue, 19 Jul 2016 22:50:26 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 1856026253 for ; Tue, 19 Jul 2016 22:50:26 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 0CF0C276AE; Tue, 19 Jul 2016 22:50:26 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8B56C26253 for ; Tue, 19 Jul 2016 22:50:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752036AbcGSWuY (ORCPT ); Tue, 19 Jul 2016 18:50:24 -0400 Received: from mail-pa0-f68.google.com ([209.85.220.68]:34975 "EHLO mail-pa0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751785AbcGSWuX (ORCPT ); Tue, 19 Jul 2016 18:50:23 -0400 Received: by mail-pa0-f68.google.com with SMTP id cf3so2057849pad.2; Tue, 19 Jul 2016 15:50:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:from:to:cc:subject:date:in-reply-to:references; bh=3pagDDpDJF+jK7z+oN8fU8v+HrO00e9bUFcm1R/yzuI=; b=XnKUIhQKnTCmgVMiOBd85p+sfxsLPe/2zRWDp/4QgGZaEhulDtY8RCYsCDvEgXBtTv YRc1LHttUmC9j13Uj/4h4jHdhd8uPj5wlBYtNig4yYZIszouzDgWNoop8PZ2eP8LcHS5 ACbujPrWiM2knyFp335KE8xzEjd7odwNGvVdbH7iifcsEIqNG1m9jdODEV7URkv2+KO2 UAHidI2Mae89V9YDjIOtDL1u9/3e/Fwe6Gjm0O90BMKS4MNCJPI6Ix4WkyF8Il8og8VG n1IpcA6atB93zRtq00shKkQuKfKNOfuR9B0GdTJxWCrFVEuKfH1qYJ22qUTs7fRxTqDe GHow== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:message-id:from:to:cc:subject:date:in-reply-to :references; bh=3pagDDpDJF+jK7z+oN8fU8v+HrO00e9bUFcm1R/yzuI=; b=RIVROfnC1QYif4rtzNmXuR8xhvSFcmGQKe89Bvzl0X4ZN16AMLWb3Mpbm3Bw/n2Tfp QXF6JWi70bo5OdvtzX5DABAyR/TAfaSmPAW3hme0ltlMxavzxDTTFFsszlajBccVBdsh P/1OJN/g6zXDe7WgxkF0jjMLgtlhfTTwIrIBqisTCQaR6M01EHcmu+ftsRI8veU6sccX WgnRQX1EJar4NaLAG21aoRT76HHEuWMo4ZhzDqpIi1Kxn3WwDBijCT127+bxxz4xvx2Q KN6AUzgo9GWYC9Gko8mEdr7qL0lwZkoUh6XMoKnbAEU4PARAgcuyAAAIM3N10867VNNi LqMg== X-Gm-Message-State: ALyK8tJxJu396wjo+bseSPXAW+o61Tp/cbqMeOSN9t9xdP4XfrWCaJdWL8F1kTz3cQNYqQ== X-Received: by 10.66.146.69 with SMTP id ta5mr65840885pab.157.1468968622578; Tue, 19 Jul 2016 15:50:22 -0700 (PDT) Received: from localhost.localdomain ([2404:c805:e00:4700:ae22:bff:fe29:e60c]) by smtp.gmail.com with ESMTPSA id q1sm7382506pfd.48.2016.07.19.15.50.20 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 19 Jul 2016 15:50:21 -0700 (PDT) Message-ID: <578eaead.0198620a.7cf53.28c1@mx.google.com> X-Google-Original-Message-ID: <20160719225014.1851-1-me> From: tom.ty89@gmail.com X-Google-Original-From: me To: tj@kernel.org, hare@suse.de Cc: linux-ide@vger.kernel.org, linux-scsi@vger.kernel.org, Tom Yan Subject: [PATCH] libata-scsi: fix read-only bits checking in ata_mselect_*() Date: Wed, 20 Jul 2016 06:50:14 +0800 X-Mailer: git-send-email 2.9.0 In-Reply-To: <578e979d.d40c620a.f5800.0924@mx.google.com> References: <578e979d.d40c620a.f5800.0924@mx.google.com> Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Tom Yan Commit 7780081c1f04 ("libata-scsi: Set information sense field for invalid parameter") changed how ata_mselect_*() make sure read-only bits are not modified. The new implementation introduced a bug that the read-only bits in the byte that has a changeable bit will not be checked. Added the necessary check, with comments explaining the heuristic. Signed-off-by: Tom Yan diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c index 06afe63..005d186 100644 --- a/drivers/ata/libata-scsi.c +++ b/drivers/ata/libata-scsi.c @@ -3617,8 +3617,18 @@ static int ata_mselect_caching(struct ata_queued_cmd *qc, */ ata_msense_caching(dev->id, mpage, false); for (i = 0; i < CACHE_MPAGE_LEN - 2; i++) { - if (i == 0) - continue; + /* Check the first byte */ + if (i == 0) { + /* except the WCE bit */ + if (mpage[i + 2] & 0xfb != buf[i] & 0xfb) { + continue; + } else { + *fp = i; + return -EINVAL; + } + } + + /* Check the remaining bytes */ if (mpage[i + 2] != buf[i]) { *fp = i; return -EINVAL; @@ -3672,8 +3682,18 @@ static int ata_mselect_control(struct ata_queued_cmd *qc, */ ata_msense_control(dev, mpage, false); for (i = 0; i < CONTROL_MPAGE_LEN - 2; i++) { - if (i == 0) - continue; + /* Check the first byte */ + if (i == 0) { + /* except the D_SENSE bit */ + if (mpage[i + 2] & 0xfb != buf[i] & 0xfb) { + continue; + } else { + *fp = i; + return -EINVAL; + } + } + + /* Check the remaining bytes */ if (mpage[2 + i] != buf[i]) { *fp = i; return -EINVAL;