[PATCH 2/2] scsi: sd: Fix data corruption in WRITE SAME(10) discards

[Chris Down]

We already cap the discard length in writesame_10 and writesame_zero
mode, but we still truncate the starting LBA to 32 bits. A discard at
or above block 2^32 can corrupt live data near the start of the disk
and still report success.

Discard is advisory, so return BLK_STS_NOTSUPP if the request won't
fit in WRITE SAME(10). Discards that fit can still go through.

Fixes: c98a0eb0e90d ("[SCSI] sd: Logical Block Provisioning update")
Cc: <stable@xxxxxxxxxxxxxxx>
Signed-off-by: Chris Down <chris@xxxxxxxxxxxxxx>
---
 drivers/scsi/sd.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index a28d11886aca..9b8530267b4a 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1131,6 +1131,9 @@ static blk_status_t sd_setup_write_same10_cmnd(struct scsi_cmnd *cmd,
 	u32 data_len = sdp->sector_size;
 	blk_status_t ret;
 
+	if (lba > 0xffffffff || nr_blocks > 0xffff)
+		return BLK_STS_NOTSUPP;
+
 	if (!sd_set_special_bvec(cmd, data_len))
 		return BLK_STS_RESOURCE;
 
-- 
2.54.0