Re: [PATCH v7 2/6] ata: libata-scsi: convert dev->sdev to per-LUN array

From: Hannes Reinecke

Date: Thu Jun 11 2026 - 02:21:39 EST


On 6/11/26 04:43, Phil Pemberton wrote:
Multi-LUN ATAPI devices (PD/CD combos, CD changers) share a single
ata_device but expose multiple scsi_devices. The previous single
dev->sdev pointer could only track one LUN, making all other LUNs
invisible to code that operates on sdevs: port detach, suspend/resume,
ACPI uevent, ZPODD, media change notification, and EH teardown.

Replace the scalar struct scsi_device *sdev with a fixed-size array
dev->sdev[ATAPI_MAX_LUN] indexed by LUN number, where ATAPI_MAX_LUN
is 8 (the SCSI-2 ceiling, LUN values 0..7). All callers are updated
to iterate the full array and skip NULL slots; only populated LUN slots
are ever non-NULL so single-LUN devices (the vast majority) see no
change in behaviour.

Add an inline helper ata_dev_scsi_device(dev, lun) that returns
dev->sdev[lun] guarded by a WARN_ON_ONCE(lun >= ATAPI_MAX_LUN) bounds
check. Use it for the hardcoded LUN-0 references in libata-acpi
(uevent kobj), libata-zpodd (disk events, wake notify for all LUNs),
and the door-lock and OF-node paths in libata-scsi.

Key changes per call site:
- ata_scsi_dev_config: bounds-check lun, assign sdev to dev->sdev[sdev->lun]
- ata_scsi_sdev_destroy: clear per-LUN slot; trigger ATA detach only
when the last populated LUN is destroyed
- ata_port_detach: iterate all ATAPI_MAX_LUN slots descending;
clear dev->sdev[lun] before unlock to close
the UAF window (Hannes Reinecke)
- ata_scsi_offline_dev: iterate all slots
- ata_scsi_remove_dev: snapshot all LUN slots then remove outside lock
- ata_scsi_media_change_notify: send event to all populated LUNs
- ata_scsi_dev_rescan: snapshot all LUNs under lock, then resume and
rescan each; release remaining refs on early exit
- ACPI, ZPODD, door-lock: use ata_dev_scsi_device(dev, 0)
- ZPODD disk-events: iterate all LUNs for enable/disable and wake

Signed-off-by: Phil Pemberton <philpem@xxxxxxxxxxxxx>
---
drivers/ata/libata-acpi.c | 9 +-
drivers/ata/libata-core.c | 11 ++-
drivers/ata/libata-scsi.c | 164 +++++++++++++++++++++----------------
drivers/ata/libata-zpodd.c | 27 ++++--
include/linux/libata.h | 10 ++-
5 files changed, 138 insertions(+), 83 deletions(-)


Reviewed-by: Hannes Reinecke <hare@xxxxxxxxxx>

Cheers,

Hannes
--
Dr. Hannes Reinecke Kernel Storage Architect
hare@xxxxxxx +49 911 74053 688
SUSE Software Solutions GmbH, Frankenstr. 146, 90461 Nürnberg
HRB 36809 (AG Nürnberg), GF: I. Totev, A. McDonald, W. Knoblich