Reject an over-length CDB on every transport, splice H.264 param sets in place
Two fixes from round 5. The Linux and Windows backends truncated a CDB longer than 16 bytes (`cdb.len().min(16)`) where macOS returned InvalidCdbLength. Under SPC-4 a command's length is fixed by its opcode group code, so a shortened CDB is not a shorter form of the same command — it is a DIFFERENT command, and the drive executes it and answers GOOD with data for a request nobody made. A silently wrong result on the layer everything else sits on. Rather than mirror the guard a third time it now lives in scsi::mod as checked_cdb_len, with all three backends routed through it, so it cannot drift per platform again. That also makes it testable everywhere: each platform module is cfg-gated to its own host, so a guard inlined into linux.rs and windows.rs would have had no test coverage on any single machine. The shared helper is the only place the behaviour can be asserted on every platform's CI. The two existing macOS tests were tautological — they replicated the guard's logic inline instead of calling it, so they would have passed with the guard deleted. They now call the real helper. Separately, the H.264 keyframe parameter-set re-assert grew a few-hundred-byte prefix buffer to the full access-unit size, copied the whole frame into it, and dropped the presized buffer: one extra whole-frame allocation and copy per keyframe. A UHD title is ~200,000 frames of 150-400 KB with a keyframe every second or two, so that is thousands of avoidable multi-hundred-KB copies per title, each large enough to go through mmap. It now splices into the reserved headroom in place. This mirrors the identical fix already made in hevc.rs, which the H.264 path had drifted from. Byte-for-byte equivalence is pinned by a test whose expected literals were captured from the pre-change implementation, and which I confirmed still passes when the old build-and-copy code is restored. The no-reallocation claim is measured rather than argued: a counter over 30 bare keyframes, which reports 30 of 30 against the old path and 0 with the splice. The reallocation test initially passed even with PARAM_REASSERT_HEADROOM set to zero, because a small parameter set fits in the presize's incidental slack — it proved the fixture did not reallocate, not that the headroom prevented it. Its SPS is now large enough that the constant is load-bearing, so zeroing it fails the test. Not verified: no runtime behaviour on Linux or Windows: no drive, no ioctl. Both files were confirmed to compile for their own targets.
This commit is contained in:
Matthew Jackson
+12
-1
@@ -28,6 +28,11 @@ const SG_DXFER_TO_DEV: i32 = -2;
|
||||
const SG_DXFER_FROM_DEV: i32 = -3;
|
||||
const SG_FLAG_Q_AT_HEAD: u32 = 0x10;
|
||||
|
||||
/// Width of `sg_io_hdr.cmdp` as far as SG_IO is concerned: `cmd_len` is a
|
||||
/// single byte and every SPC-4/MMC command this crate issues is 6, 10, 12 or
|
||||
/// 16 bytes. Matches `K_MAX_CDB_SIZE` in the macOS and Windows backends.
|
||||
const K_MAX_CDB_SIZE: usize = 16;
|
||||
|
||||
#[repr(C)]
|
||||
#[allow(non_camel_case_types)]
|
||||
struct sg_io_hdr {
|
||||
@@ -289,7 +294,13 @@ impl ScsiTransport for SgIoTransport {
|
||||
DataDirection::FromDevice => SG_DXFER_FROM_DEV,
|
||||
DataDirection::ToDevice => SG_DXFER_TO_DEV,
|
||||
};
|
||||
let cmd_len = cdb.len().min(16) as u8;
|
||||
// Reject an over-length CDB rather than truncating it. This used to be
|
||||
// `cdb.len().min(16) as u8`, which silently dropped the tail: SPC-4
|
||||
// fixes a command's length by its opcode group code, so the shortened
|
||||
// CDB is a DIFFERENT command, which the drive executes and answers
|
||||
// with GOOD status and data for a request nobody made. Matches the
|
||||
// macOS and Windows backends (all three call the same helper).
|
||||
let cmd_len = super::checked_cdb_len(cdb, K_MAX_CDB_SIZE)?;
|
||||
|
||||
let mut sense = [0u8; 32];
|
||||
let mut hdr: sg_io_hdr = unsafe { std::mem::zeroed() };
|
||||
|
||||
+15
-26
@@ -161,13 +161,11 @@ impl ScsiTransport for MacScsiTransport {
|
||||
let mut task_status: u8 = 0xFF;
|
||||
let mut transfer_count: u64 = 0;
|
||||
|
||||
if cdb.len() > K_MAX_CDB_SIZE {
|
||||
return Err(Error::InvalidCdbLength {
|
||||
len: cdb.len(),
|
||||
max: K_MAX_CDB_SIZE,
|
||||
});
|
||||
}
|
||||
let cdb_len = cdb.len() as u8;
|
||||
// Reject an over-length CDB rather than truncating it. The guard now
|
||||
// lives in `scsi::checked_cdb_len`, shared with the Linux and Windows
|
||||
// backends (which used to truncate here instead of erroring) so it
|
||||
// cannot drift per platform again.
|
||||
let cdb_len = super::checked_cdb_len(cdb, K_MAX_CDB_SIZE)?;
|
||||
let kr = unsafe {
|
||||
shim_execute(
|
||||
cdb.as_ptr(),
|
||||
@@ -266,39 +264,30 @@ mod tests {
|
||||
use crate::error::Error;
|
||||
|
||||
/// A CDB longer than K_MAX_CDB_SIZE must be rejected with
|
||||
/// `Error::InvalidCdbLength` before the shim is ever called.
|
||||
/// This test exercises the length guard portably — it calls the
|
||||
/// guard logic directly without opening an IOKit handle.
|
||||
/// `Error::InvalidCdbLength` before the shim is ever called. Exercises the
|
||||
/// real guard `MacScsiTransport::execute` uses, without opening an IOKit
|
||||
/// handle.
|
||||
#[test]
|
||||
fn oversized_cdb_returns_invalid_cdb_length() {
|
||||
// Build a CDB one byte over the limit.
|
||||
let long_cdb = [0u8; K_MAX_CDB_SIZE + 1];
|
||||
// Replicate the guard logic from MacScsiTransport::execute so
|
||||
// this test runs on Linux CI as well (no IOKit present there).
|
||||
let result: Result<(), Error> = if long_cdb.len() > K_MAX_CDB_SIZE {
|
||||
Err(Error::InvalidCdbLength {
|
||||
len: long_cdb.len(),
|
||||
max: K_MAX_CDB_SIZE,
|
||||
})
|
||||
} else {
|
||||
Ok(())
|
||||
};
|
||||
match result {
|
||||
match crate::scsi::checked_cdb_len(&long_cdb, K_MAX_CDB_SIZE) {
|
||||
Err(Error::InvalidCdbLength { len, max }) => {
|
||||
assert_eq!(len, K_MAX_CDB_SIZE + 1);
|
||||
assert_eq!(max, K_MAX_CDB_SIZE);
|
||||
}
|
||||
other => panic!("expected InvalidCdbLength, got {:?}", other),
|
||||
other => panic!("expected InvalidCdbLength, got {other:?}"),
|
||||
}
|
||||
}
|
||||
|
||||
/// A CDB exactly at the limit must not trigger the guard.
|
||||
/// A CDB exactly at the limit must not trigger the guard, and its length
|
||||
/// reaches the shim verbatim.
|
||||
#[test]
|
||||
fn max_length_cdb_does_not_trigger_guard() {
|
||||
let cdb = [0u8; K_MAX_CDB_SIZE];
|
||||
let triggered = cdb.len() > K_MAX_CDB_SIZE;
|
||||
assert!(
|
||||
!triggered,
|
||||
assert_eq!(
|
||||
crate::scsi::checked_cdb_len(&cdb, K_MAX_CDB_SIZE).ok(),
|
||||
Some(K_MAX_CDB_SIZE as u8),
|
||||
"CDB of exactly K_MAX_CDB_SIZE should not trigger guard"
|
||||
);
|
||||
}
|
||||
|
||||
@@ -101,6 +101,85 @@ pub const SCSI_STATUS_CHECK_CONDITION: u8 = 0x02;
|
||||
/// [`Error::ScsiError`] with `sense = None`.
|
||||
pub const SCSI_STATUS_TRANSPORT_FAILURE: u8 = 0xFF;
|
||||
|
||||
// ── CDB length validation ──────────────────────────────────────────────────
|
||||
|
||||
/// Validate a CDB against a transport's CDB field width, returning the length
|
||||
/// as the `u8` every backend's pass-through descriptor wants.
|
||||
///
|
||||
/// A CDB longer than the field must be REJECTED, never truncated. Under SPC-4
|
||||
/// the opcode's group code (bits 7-5 of byte 0) fixes the CDB length, so
|
||||
/// dropping the tail bytes does not produce a shorter form of the same
|
||||
/// command — it produces a DIFFERENT command with a different meaning for the
|
||||
/// bytes that remain. The drive will usually execute it and return GOOD
|
||||
/// status with data for a request the caller never made: a silently wrong
|
||||
/// result, on the transport layer everything else in the crate sits on.
|
||||
///
|
||||
/// Lives here, shared by all three platform backends, so the guard cannot
|
||||
/// drift per platform (it previously truncated on Linux and Windows while
|
||||
/// erroring on macOS — the "works on my platform, not theirs" class).
|
||||
pub(crate) fn checked_cdb_len(cdb: &[u8], max: usize) -> Result<u8> {
|
||||
if cdb.len() > max {
|
||||
return Err(Error::InvalidCdbLength {
|
||||
len: cdb.len(),
|
||||
max,
|
||||
});
|
||||
}
|
||||
// `max` is 16 on every backend, so the cast cannot truncate.
|
||||
Ok(cdb.len() as u8)
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod cdb_len_tests {
|
||||
use super::*;
|
||||
|
||||
/// The maximum every backend declares (`K_MAX_CDB_SIZE`).
|
||||
const MAX: usize = 16;
|
||||
|
||||
/// A CDB one byte over the transport's field width must be REJECTED with
|
||||
/// [`Error::InvalidCdbLength`], never silently shortened to `max`. This is
|
||||
/// the cross-platform test for the guard that `linux.rs`, `macos.rs` and
|
||||
/// `windows.rs` all route through — none of those three modules is
|
||||
/// compiled on more than one host, so the shared helper is the only place
|
||||
/// the behaviour can be tested on every platform's CI.
|
||||
#[test]
|
||||
fn oversized_cdb_is_rejected_not_truncated() {
|
||||
let cdb = [0u8; MAX + 1];
|
||||
match checked_cdb_len(&cdb, MAX) {
|
||||
Err(Error::InvalidCdbLength { len, max }) => {
|
||||
assert_eq!(len, MAX + 1);
|
||||
assert_eq!(max, MAX);
|
||||
}
|
||||
Err(other) => panic!("expected InvalidCdbLength, got {other:?}"),
|
||||
Ok(n) => panic!(
|
||||
"over-length CDB was accepted and truncated to {n} bytes — the drive \
|
||||
would execute a DIFFERENT command than the caller asked for"
|
||||
),
|
||||
}
|
||||
}
|
||||
|
||||
/// A CDB exactly at the field width is legal and passes through untouched.
|
||||
#[test]
|
||||
fn max_length_cdb_is_accepted() {
|
||||
let cdb = [0u8; MAX];
|
||||
assert_eq!(checked_cdb_len(&cdb, MAX).ok(), Some(MAX as u8));
|
||||
}
|
||||
|
||||
/// Every real CDB length (SPC-4 groups 0-5: 6, 10, 12, 16 bytes) is
|
||||
/// accepted and reported verbatim, and an empty CDB reports 0 — the
|
||||
/// backends' own empty-CDB guards handle that case.
|
||||
#[test]
|
||||
fn in_range_cdb_lengths_pass_through_verbatim() {
|
||||
for len in [0usize, 6, 10, 12, 16] {
|
||||
let cdb = vec![0u8; len];
|
||||
assert_eq!(
|
||||
checked_cdb_len(&cdb, MAX).ok(),
|
||||
Some(len as u8),
|
||||
"CDB of {len} bytes must be accepted verbatim"
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// ── SPC-4 sense keys (§4.5.6 Table 28) ─────────────────────────────────────
|
||||
//
|
||||
// Broad failure category returned in a CHECK CONDITION reply's sense data.
|
||||
|
||||
+8
-1
@@ -436,7 +436,14 @@ impl ScsiTransport for SptiTransport {
|
||||
|
||||
let mut sptwb: SptwbDirect = unsafe { std::mem::zeroed() };
|
||||
|
||||
let cdb_len = cdb.len().min(K_MAX_CDB_SIZE);
|
||||
// Reject an over-length CDB rather than truncating it. This used to be
|
||||
// `cdb.len().min(K_MAX_CDB_SIZE)`, and the copy into `sptwb.spt.Cdb`
|
||||
// below then took only the first 16 bytes: SPC-4 fixes a command's
|
||||
// length by its opcode group code, so the shortened CDB is a DIFFERENT
|
||||
// command, which the drive executes and answers with GOOD status and
|
||||
// data for a request nobody made. Matches the Linux and macOS backends
|
||||
// (all three call the same helper).
|
||||
let cdb_len = usize::from(super::checked_cdb_len(cdb, K_MAX_CDB_SIZE)?);
|
||||
sptwb.spt.Length = std::mem::size_of::<ScsiPassThroughDirect>() as u16;
|
||||
sptwb.spt.CdbLength = cdb_len as u8;
|
||||
sptwb.spt.SenseInfoLength = K_SENSE_SIZE as u8;
|
||||
|
||||
Reference in New Issue
Block a user