linux-kernel - [RFC PATCH] ata: add lun validity check on ata_sas

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Thu, 18 Mar 2021 20:53:53 +0800
From:   Wu Bo <wubo40@...wei.com>
To:     <axboe@...nel.dk>, <linux-ide@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>
CC:     <linfeilong@...wei.com>, <yanaijie@...wei.com>, <wubo40@...wei.com>
Subject: [RFC PATCH] ata: add lun validity check on ata_sas_queuecmd

Hi all,

After executing rescan-scsi-bus.sh -r -m, the system adds 255 more disks.

The reason is as follows:
1. Execute the rescan-scsi-bus.sh script to scan all targets.
2. The REPORT_LUNS failed due to some errors on the device of sdb(LUN0).
3. Do a sequential scan on the target which sdb belongs to.
4. Have already scanned LUN 0, so start at LUN 1. and keep scanning until
   reach the max.
5. For SATA device, the driver of ata does not check the validity of 
   LUN ID before dispatch commands to ATA device. 
   Result in LUN 1~MAX successfully added to the system.

trace:
__scsi_scan_target()
   -> scsi_report_lun_scan()
   -> scsi_sequential_lun_scan()

Steps to reproduce as follow:

step1: lsscsi
[1:0:0:0]    disk    ATA      /dev/sda 
[1:0:1:0]    disk    ATA      /dev/sdb 
[1:0:2:0]    disk    ATA      /dev/sdc 
[1:0:3:0]    disk    ATA      /dev/sdd 
[1:0:4:0]    disk    ATA      /dev/sde

step2: echo "offline" > /sys/block/sdb/device/state
step3: rescan-scsi-bus.sh -r -m
step4: lsscsi
[1:0:0:0]    disk    ATA      /dev/sda 
[1:0:1:1]    disk    ATA      /dev/sdr 
[1:0:1:2]    disk    ATA      /dev/sds 
[1:0:1:3]    disk    ATA      /dev/sdt 
[1:0:1:4]    disk    ATA      /dev/sdu 
......
[1:0:1:251]  disk    ATA      /dev/sdjh
[1:0:1:252]  disk    ATA      /dev/sdji
[1:0:1:253]  disk    ATA      /dev/sdjj
[1:0:1:254]  disk    ATA      /dev/sdjk
[1:0:1:255]  disk    ATA      /dev/sdjl
[1:0:2:0]    disk    ATA      /dev/sdc 
[1:0:3:0]    disk    ATA      /dev/sdd 
[1:0:4:0]    disk    ATA      /dev/sde 

Signed-off-by: Wu Bo <wubo40@...wei.com>
---
 drivers/ata/libata-sata.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/ata/libata-sata.c b/drivers/ata/libata-sata.c
index c16423e..e30a412 100644
--- a/drivers/ata/libata-sata.c
+++ b/drivers/ata/libata-sata.c
@@ -1242,7 +1242,8 @@ int ata_sas_queuecmd(struct scsi_cmnd *cmd, struct ata_port *ap)

 	ata_scsi_dump_cdb(ap, cmd);

-	if (likely(ata_dev_enabled(ap->link.device)))
+	if (likely(ata_dev_enabled(ap->link.device)) &&
+	    (cmd->device->lun == 0))
 		rc = __ata_scsi_queuecmd(cmd, ap->link.device);
 	else {
 		cmd->result = (DID_BAD_TARGET << 16);
-- 
1.8.3.1