From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1752885AbdCTGBC (ORCPT <rfc822;w@1wt.eu>);
        Mon, 20 Mar 2017 02:01:02 -0400
Received: from szxga02-in.huawei.com ([45.249.212.188]:3905 "EHLO
        dggrg02-dlp.huawei.com" rhost-flags-OK-FAIL-OK-FAIL)
        by vger.kernel.org with ESMTP id S1750867AbdCTGA6 (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Mon, 20 Mar 2017 02:00:58 -0400
Subject: Re: [PATCH] scsi: sr: fix oob access in get_capabilities
To: "Martin K. Petersen" <martin.petersen@oracle.com>
References: <1488536272-10509-1-git-send-email-wangkefeng.wang@huawei.com>
 <yq1r31yf5ie.fsf@oracle.com>
 <3f08ece0-531e-6853-d47d-a860e81e55d6@huawei.com>
 <yq160j7lbx1.fsf@oracle.com>
CC: Jens Axboe <axboe@kernel.dk>,
        "James E.J. Bottomley" <jejb@linux.vnet.ibm.com>,
        <linux-scsi@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
        Douglas Gilbert <dgilbert@interlog.com>
From: Kefeng Wang <wangkefeng.wang@huawei.com>
Message-ID: <0d4c496b-c435-b622-58f8-25bd4490186a@huawei.com>
Date: Mon, 20 Mar 2017 14:00:17 +0800
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101
 Thunderbird/45.7.1
MIME-Version: 1.0
In-Reply-To: <yq160j7lbx1.fsf@oracle.com>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
X-Originating-IP: [10.177.19.180]
X-CFilter-Loop: Reflected
X-Mirapoint-Virus-RAPID-Raw: score=unknown(0),
        refid=str=0001.0A020201.58CF6FF8.05B3,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0,
        ip=0.0.0.0,
        so=2014-11-16 11:51:01,
        dmn=2013-03-21 17:37:32
X-Mirapoint-Loop-Id: a74399f5bfbc952a40a784bf1ebc9804
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org



On 2017/3/18 7:29, Martin K. Petersen wrote:
> Kefeng Wang <wangkefeng.wang@huawei.com> writes:
> 
> Kefeng,
> 
>> root@localhost ~]# sg_modes -p 0x2a /dev/sr0
>>     QEMU      QEMU DVD-ROM      0.15   peripheral_type: cd/dvd [0x5]
>> Mode parameter header from MODE SENSE(10):
>> Invalid block descriptor length=512, ignore
>>   Mode data length=36, medium type=0x70, specific param=0x00, longlba=0
>>   Block descriptor length=0
>>>> MM capabilities and mechanical status (obsolete), page_control: current
>>  00     2a 12 00 00 71 60 29 00  02 c2 00 02 02 00 02 c2
>>  10     00 00 00 00
>> Unexpectedly received extra mode page responses, ignore
> 
> That looks pretty broken.
> 
> Could you try the following patch?

The issue still exists, the patch return zero in scsi_mode_sense(), but zero means
SAM_STAT_GOOD in scsi_status_is_good(), so n will be still bigger than 512;

Thanks,