Re: [PATCH v3] ata: libata-scsi: reject data-in commands with a data-out buffer

[Damien Le Moal <dlemoal@kernel.org>]

On 11/4/26 22:06, Zhao Gongyi wrote:
> SG_IO can submit a data-in SCSI command with DMA_TO_DEVICE. The
> scatterlist can then contain pages pinned without write access.
> ata_scsi_rbuf_fill() writes simulated replies to that scatterlist;
> in the reported case, the copy tried to write the shared zero page
> and faulted in the kernel.
> 
> The same mismatch can affect SG_IO commands translated by libata.
> ZBC IN and GET PHYSICAL ELEMENT STATUS completion handlers can modify
> the receive buffer even if the drive aborts the command. For ATAPI,
> the successful INQUIRY completion also rewrites the buffer in
> atapi_fixup_inquiry().
> 
> Reject these mismatched commands before the buffer is written or the
> command is issued. Report ABORTED COMMAND / DATA IN BUFFER ERROR because
> the CDB itself can be valid; the supplied transfer direction is wrong.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Link: https://lore.kernel.org/r/20261027090809.94126-1-zhaogongyi@bytedance.com
> Suggested-by: Niklas Cassel <cassel@kernel.org>
> Suggested-by: Damien Le Moal <dlemoal@kernel.org>
> Cc: stable@vger.kernel.org
> Signed-off-by: Zhao Gongyi <zhaogongyi@bytedance.com>

Looks OK. If needed, we can tweak the sense code later.

Reviewed-by: Damien Le Moal <dlemoal@kernel.org>

-- 
Damien Le Moal
Western Digital Research