[ Sasha's backport helper bot ]
Hi,
The upstream commit SHA1 provided is correct: 17b49bcbf8351d3dbe57204468ac34f033ed60bc
WARNING: Author mismatch between patch and upstream commit:
Backport author: Vasiliy Kovalev <kovalev@xxxxxxxxxxxx>
Commit author: Damien Le Moal <damien.lemoal@xxxxxxx>
Status in newer kernel trees:
6.12.y | Present (exact SHA1)
6.6.y | Present (exact SHA1)
6.1.y | Present (exact SHA1)
5.15.y | Present (different SHA1: e15de347faf4)
5.10.y | Not found
Note: The patch differs from the upstream commit:
---
1: 17b49bcbf8351 ! 1: 5e9ba35e00eb9 scsi: core: Fix scsi_mode_sense() buffer length handling
@@ Metadata
## Commit message ##
scsi: core: Fix scsi_mode_sense() buffer length handling
+ commit 17b49bcbf8351d3dbe57204468ac34f033ed60bc upstream.
+
Several problems exist with scsi_mode_sense() buffer length handling:
1) The allocation length field of the MODE SENSE(10) command is 16-bits,
@@ Commit message
Link: https://lore.kernel.org/r/20210820070255.682775-2-damien.lemoal@xxxxxxx
Signed-off-by: Damien Le Moal <damien.lemoal@xxxxxxx>
Signed-off-by: Martin K. Petersen <martin.petersen@xxxxxxxxxx>
+ Signed-off-by: Vasiliy Kovalev <kovalev@xxxxxxxxxxxx>
## drivers/scsi/scsi_lib.c ##
@@ drivers/scsi/scsi_lib.c: EXPORT_SYMBOL_GPL(scsi_mode_select);
@@ drivers/scsi/scsi_lib.c: scsi_mode_sense(struct scsi_device *sdev, int dbd, int
+ * too large for MODE SENSE single byte
+ * allocation length field.
*/
- if (use_10_for_ms) {
-+ if (len > 255)
-+ return -EIO;
- sdev->use_10_for_ms = 0;
- goto retry;
- }
++ if (len > 255)
++ return -EIO;
+ sdev->use_10_for_ms = 0;
+ goto retry;
+ }
@@ drivers/scsi/scsi_lib.c: scsi_mode_sense(struct scsi_device *sdev, int dbd, int modepage,
- data->longlba = 0;
- data->block_descriptor_length = 0;
- } else if (use_10_for_ms) {
-- data->length = buffer[0]*256 + buffer[1] + 2;
-+ data->length = get_unaligned_be16(&buffer[0]) + 2;
- data->medium_type = buffer[2];
- data->device_specific = buffer[3];
- data->longlba = buffer[4] & 0x01;
-- data->block_descriptor_length = buffer[6]*256
-- + buffer[7];
-+ data->block_descriptor_length = get_unaligned_be16(&buffer[6]);
- } else {
- data->length = buffer[0] + 1;
- data->medium_type = buffer[1];
+ data->longlba = 0;
+ data->block_descriptor_length = 0;
+ } else if (use_10_for_ms) {
+- data->length = buffer[0]*256 + buffer[1] + 2;
++ data->length = get_unaligned_be16(&buffer[0]) + 2;
+ data->medium_type = buffer[2];
+ data->device_specific = buffer[3];
+ data->longlba = buffer[4] & 0x01;
+- data->block_descriptor_length = buffer[6]*256
+- + buffer[7];
++ data->block_descriptor_length = get_unaligned_be16(&buffer[6]);
+ } else {
+ data->length = buffer[0] + 1;
+ data->medium_type = buffer[1];
---
Results of testing on various branches:
| Branch | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-5.10.y | Success | Success |
