[PATCH 1/2] scsi: sd: Fix data corruption in WRITE SAME(10) write zeroes

[Chris Down]

In writesame_10_unmap mode, we send write zeroes as WRITE SAME(10).
If the LBA or count doesn't fit, we truncate it and can return
success without zeroing the requested range. If the LBA wraps, we
can also corrupt live data near the start of the disk.

Cap the queue limit when sd selects this mode so large requests can
still unmap in chunks. If the LBA or count still won't fit, fall back
to WRITE SAME(16) with UNMAP clear. All the caller needs is for the
requested blocks to read back as zeroes.

Fixes: e4b878371b85 ("sd: implement unmapping Write Zeroes")
Cc: <stable@xxxxxxxxxxxxxxx>
Signed-off-by: Chris Down <chris@xxxxxxxxxxxxxx>
---
 drivers/scsi/sd.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index dc45df819c42..a28d11886aca 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1164,7 +1164,10 @@ static blk_status_t sd_setup_write_zeroes_cmnd(struct scsi_cmnd *cmd)
 		case SD_ZERO_WS16_UNMAP:
 			return sd_setup_write_same16_cmnd(cmd, true);
 		case SD_ZERO_WS10_UNMAP:
-			return sd_setup_write_same10_cmnd(cmd, true);
+			if (lba <= 0xffffffff && nr_blocks <= 0xffff)
+				return sd_setup_write_same10_cmnd(cmd, true);
+			/* Unmapping is optional for write zeroes. */
+			break;
 		}
 	}
 
@@ -1221,6 +1224,11 @@ static void sd_config_write_same(struct scsi_disk *sdkp,
 	else
 		sdkp->zeroing_mode = SD_ZERO_WRITE;
 
+	/* Split large requests so they can still unmap. */
+	if (sdkp->zeroing_mode == SD_ZERO_WS10_UNMAP)
+		sdkp->max_ws_blocks = min(sdkp->max_ws_blocks,
+					  (u32)SD_MAX_WS10_BLOCKS);
+
 	if (sdkp->max_ws_blocks &&
 	    sdkp->physical_block_size > logical_block_size) {
 		/*
-- 
2.54.0