[PATCH] ata: libata-scsi: avoid READ CAPACITY 16 underflow

From: shao.mingyin

Date: Tue Nov 03 2026 - 06:14:38 EST


ata_scsiop_read_cap() starts with

u64 last_lba = dev->n_sectors - 1;

ata_dev_configure() sets n_sectors to zero for security locked drives, to
prevent any I/O. The READ CAPACITY 10 branch clamps the resulting
underflow to 0xffffffff (still wrong, but bounded), while READ CAPACITY 16
has no clamp and reports 0xffffffffffffffff, i.e. a capacity of about
8 ZiB, to the SCSI layer.

Use a zero last LBA when the device has no sectors.

Fixes: 61d79a8eb362 ("libata: Report disk alignment and physical block size")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Shao Mingyin <shao.mingyin@xxxxxxxxxx>
---
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index a61fb0331279..eaf86dc2cefc 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -2984,7 +2984,7 @@ static unsigned int ata_scsiop_read_cap(struct ata_device *dev,
struct scsi_cmnd *cmd, u8 *rbuf)
{
u8 *scsicmd = cmd->cmnd;
- u64 last_lba = dev->n_sectors - 1; /* LBA of the last block */
+ u64 last_lba = dev->n_sectors ? dev->n_sectors - 1 : 0; /* LBA of the last block */
u32 sector_size; /* physical sector size in bytes */
u8 log2_per_phys;
u16 lowest_aligned;