In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes<\/p>\n
ata_scsi_write_same_xlat() translates a SCSI WRITE SAME command with the
\nUNMAP bit set into an ATA DATA SET MANAGEMENT TRIM command. The TRIM
\ndescriptor is built by ata_format_dsm_trim_descr() into the 2048-byte
\nata_scsi_rbuf staging buffer, and the number of bytes copied is compared
\nagainst the logical sector size by the caller:<\/p>\n
\tsize = ata_format_dsm_trim_descr(scmd, trmax, block, n_block);
\n\tif (size != len)\t\t\/* len == sdp->sector_size *\/
\n\t\tgoto invalid_param_len;<\/p>\n
ata_format_dsm_trim_descr() clamps the copy length to ATA_SCSI_RBUF_SIZE
\n(2048). On a device whose logical sector size exceeds that (e.g. a 4Kn
\ndevice, where sector_size == 4096) the function can never return more than
\n2048, while the caller expects it to return sector_size. The comparison
\ntherefore always fails, so every TRIM is rejected with “Parameter list
\nlength error” and WARN_ON() splats on each attempt. TRIM \/ discard is
\nthus completely broken on such devices.<\/p>\n
The descriptor was incorrectly sized from the logical sector size. A DSM
\nTRIM payload is a list of 512-byte pages, each holding up to
\nATA_MAX_TRIM_RNUM (64) LBA Range Entries, and is independent of the logical
\nsector size. The Block Limits VPD page already advertises a single such
\npage as the maximum WRITE SAME length (65535 * ATA_MAX_TRIM_RNUM logical
\nblocks), so the block layer never sends a request that needs more than one
\npage.<\/p>\n
Emit exactly one 512-byte page, independent of the logical sector size,
\nand transfer only that page (COUNT == 1). For a 512-byte-sector device
\nthis is unchanged; devices with larger logical sectors now work instead of
\nfailing every TRIM.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes<\/p>\n
ata_scsi_write_same_xlat() translates a SCSI WRITE SAME com<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21508","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21508","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21508"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21508"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21508"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}