Stable Archive on lore.kernel.org
 help / color / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Jens Axboe <axboe@kernel.dk>, Krishna Ram Prakash R <krp@gtux.in>,
	Kees Cook <keescook@chromium.org>,
	Sasha Levin <sashal@kernel.org>,
	linux-ide@vger.kernel.org
Subject: [PATCH AUTOSEL 4.19 58/68] libata: have ata_scsi_rw_xlat() fail invalid passthrough requests
Date: Tue, 13 Aug 2019 22:15:36 -0400
Message-ID: <20190814021548.16001-58-sashal@kernel.org> (raw)
In-Reply-To: <20190814021548.16001-1-sashal@kernel.org>

From: Jens Axboe <axboe@kernel.dk>

[ Upstream commit 2d7271501720038381d45fb3dcbe4831228fc8cc ]

For passthrough requests, libata-scsi takes what the user passes in
as gospel. This can be problematic if the user fills in the CDB
incorrectly. One example of that is in request sizes. For read/write
commands, the CDB contains fields describing the transfer length of
the request. These should match with the SG_IO header fields, but
libata-scsi currently does no validation of that.

Check that the number of blocks in the CDB for passthrough requests
matches what was mapped into the request. If the CDB asks for more
data then the validated SG_IO header fields, error it.

Reported-by: Krishna Ram Prakash R <krp@gtux.in>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ata/libata-scsi.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 1984fc78c750b..3a64fa4aaf7e3 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -1803,6 +1803,21 @@ static unsigned int ata_scsi_verify_xlat(struct ata_queued_cmd *qc)
 	return 1;
 }
 
+static bool ata_check_nblocks(struct scsi_cmnd *scmd, u32 n_blocks)
+{
+	struct request *rq = scmd->request;
+	u32 req_blocks;
+
+	if (!blk_rq_is_passthrough(rq))
+		return true;
+
+	req_blocks = blk_rq_bytes(rq) / scmd->device->sector_size;
+	if (n_blocks > req_blocks)
+		return false;
+
+	return true;
+}
+
 /**
  *	ata_scsi_rw_xlat - Translate SCSI r/w command into an ATA one
  *	@qc: Storage for translated ATA taskfile
@@ -1847,6 +1862,8 @@ static unsigned int ata_scsi_rw_xlat(struct ata_queued_cmd *qc)
 		scsi_10_lba_len(cdb, &block, &n_block);
 		if (cdb[1] & (1 << 3))
 			tf_flags |= ATA_TFLAG_FUA;
+		if (!ata_check_nblocks(scmd, n_block))
+			goto invalid_fld;
 		break;
 	case READ_6:
 	case WRITE_6:
@@ -1861,6 +1878,8 @@ static unsigned int ata_scsi_rw_xlat(struct ata_queued_cmd *qc)
 		 */
 		if (!n_block)
 			n_block = 256;
+		if (!ata_check_nblocks(scmd, n_block))
+			goto invalid_fld;
 		break;
 	case READ_16:
 	case WRITE_16:
@@ -1871,6 +1890,8 @@ static unsigned int ata_scsi_rw_xlat(struct ata_queued_cmd *qc)
 		scsi_16_lba_len(cdb, &block, &n_block);
 		if (cdb[1] & (1 << 3))
 			tf_flags |= ATA_TFLAG_FUA;
+		if (!ata_check_nblocks(scmd, n_block))
+			goto invalid_fld;
 		break;
 	default:
 		DPRINTK("no-byte command\n");
-- 
2.20.1


  parent reply index

Thread overview: 69+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-08-14  2:14 [PATCH AUTOSEL 4.19 01/68] iio: adc: max9611: Fix misuse of GENMASK macro Sasha Levin
2019-08-14  2:14 ` [PATCH AUTOSEL 4.19 02/68] iio: cros_ec_accel_legacy: Fix incorrect channel setting Sasha Levin
2019-08-14  2:14 ` [PATCH AUTOSEL 4.19 03/68] HID: Add 044f:b320 ThrustMaster, Inc. 2 in 1 DT Sasha Levin
2019-08-14  2:14 ` [PATCH AUTOSEL 4.19 04/68] MIPS: kernel: only use i8253 clocksource with periodic clockevent Sasha Levin
2019-08-14  2:14 ` [PATCH AUTOSEL 4.19 05/68] mips: fix cacheinfo Sasha Levin
2019-08-14  2:14 ` [PATCH AUTOSEL 4.19 06/68] netfilter: ebtables: fix a memory leak bug in compat Sasha Levin
2019-08-14  2:14 ` [PATCH AUTOSEL 4.19 07/68] ASoC: dapm: Fix handling of custom_stop_condition on DAPM graph walks Sasha Levin
2019-08-14  2:14 ` [PATCH AUTOSEL 4.19 08/68] selftests/bpf: fix sendmsg6_prog on s390 Sasha Levin
2019-08-14  2:14 ` [PATCH AUTOSEL 4.19 09/68] bonding: Force slave speed check after link state recovery for 802.3ad Sasha Levin
2019-08-14  2:14 ` [PATCH AUTOSEL 4.19 10/68] net: mvpp2: Don't check for 3 consecutive Idle frames for 10G links Sasha Levin
2019-08-14  2:14 ` [PATCH AUTOSEL 4.19 11/68] selftests: forwarding: gre_multipath: Enable IPv4 forwarding Sasha Levin
2019-08-14  2:14 ` [PATCH AUTOSEL 4.19 12/68] selftests: forwarding: gre_multipath: Fix flower filters Sasha Levin
2019-08-14  2:14 ` [PATCH AUTOSEL 4.19 13/68] can: dev: call netif_carrier_off() in register_candev() Sasha Levin
2019-08-14  2:14 ` [PATCH AUTOSEL 4.19 14/68] can: mcp251x: add error check when wq alloc failed Sasha Levin
2019-08-14  2:14 ` [PATCH AUTOSEL 4.19 15/68] can: gw: Fix error path of cgw_module_init Sasha Levin
2019-08-14  2:14 ` [PATCH AUTOSEL 4.19 16/68] ASoC: Fail card instantiation if DAI format setup fails Sasha Levin
2019-08-14  2:14 ` [PATCH AUTOSEL 4.19 17/68] st21nfca_connectivity_event_received: null check the allocation Sasha Levin
2019-08-14  2:14 ` [PATCH AUTOSEL 4.19 18/68] st_nci_hci_connectivity_event_received: " Sasha Levin
2019-08-14  2:14 ` [PATCH AUTOSEL 4.19 19/68] ASoC: rockchip: Fix mono capture Sasha Levin
2019-08-14  2:14 ` [PATCH AUTOSEL 4.19 20/68] ASoC: ti: davinci-mcasp: Correct slot_width posed constraint Sasha Levin
2019-08-14  2:14 ` [PATCH AUTOSEL 4.19 21/68] net: usb: qmi_wwan: Add the BroadMobi BM818 card Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 22/68] qed: RDMA - Fix the hw_ver returned in device attributes Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 23/68] isdn: mISDN: hfcsusb: Fix possible null-pointer dereferences in start_isoc_chain() Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 24/68] mac80211_hwsim: Fix possible null-pointer dereferences in hwsim_dump_radio_nl() Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 25/68] netfilter: ipset: Actually allow destination MAC address for hash:ip,mac sets too Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 26/68] netfilter: ipset: Copy the right MAC address in bitmap:ip,mac and hash:ip,mac sets Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 27/68] netfilter: ipset: Fix rename concurrency with listing Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 28/68] netfilter: ebtables: also count base chain policies Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 29/68] rxrpc: Fix potential deadlock Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 30/68] rxrpc: Fix the lack of notification when sendmsg() fails on a DATA packet Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 31/68] driver core: Fix use-after-free and double free on glue directory Sasha Levin
2019-08-14  7:36   ` Greg Kroah-Hartman
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 32/68] isdn: hfcsusb: Fix mISDN driver crash caused by transfer buffer on the stack Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 33/68] net: phy: phy_led_triggers: Fix a possible null-pointer dereference in phy_led_trigger_change_speed() Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 34/68] perf bench numa: Fix cpu0 binding Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 35/68] Input: kbtab - sanity check for endpoint type Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 36/68] net: usb: pegasus: fix improper read if get_registers() fail Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 37/68] can: sja1000: force the string buffer NULL-terminated Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 38/68] can: peak_usb: " Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 39/68] net/ethernet/qlogic/qed: " Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 40/68] NFSv4: Fix a potential sleep while atomic in nfs4_do_reclaim() Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 41/68] NFS: Fix regression whereby fscache errors are appearing on 'nofsc' mounts Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 42/68] HID: quirks: Set the INCREMENT_USAGE_ON_DUPLICATE quirk on Saitek X52 Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 43/68] HID: holtek: test for sanity of intfdata Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 44/68] HID: input: fix a4tech horizontal wheel custom usage Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 45/68] drm/rockchip: Suspend DP late Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 46/68] SMB3: Fix potential memory leak when processing compound chain Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 47/68] SMB3: Kernel oops mounting a encryptData share with CONFIG_DEBUG_VIRTUAL Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 48/68] HID: hiddev: avoid opening a disconnected device Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 49/68] HID: hiddev: do cleanup in failure of opening a device Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 50/68] s390: put _stext and _etext into .text section Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 51/68] Input: iforce - add sanity checks Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 52/68] net: cxgb3_main: Fix a resource leak in a error path in 'init_one()' Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 53/68] net: stmmac: Fix issues when number of Queues >= 4 Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 54/68] net: stmmac: tc: Do not return a fragment entry Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 55/68] net: hisilicon: make hip04_tx_reclaim non-reentrant Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 56/68] net: hisilicon: fix hip04-xmit never return TX_BUSY Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 57/68] net: hisilicon: Fix dma_map_single failed on arm64 Sasha Levin
2019-08-14  2:15 ` Sasha Levin [this message]
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 59/68] libata: add SG safety checks in SFF pio transfers Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 60/68] x86/lib/cpu: Address missing prototypes warning Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 61/68] drm/vmwgfx: fix memory leak when too many retries have occurred Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 62/68] block, bfq: handle NULL return value by bfq_init_rq() Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 63/68] perf ftrace: Fix failure to set cpumask when only one cpu is present Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 64/68] perf cpumap: Fix writing to illegal memory in handling cpumap mask Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 65/68] perf pmu-events: Fix missing "cpu_clk_unhalted.core" event Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 66/68] KVM: arm64: Don't write junk to sysregs on reset Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 67/68] KVM: arm: Don't write junk to CP15 registers " Sasha Levin
2019-08-14  2:15 ` [PATCH AUTOSEL 4.19 68/68] selftests: kvm: Adding config fragments Sasha Levin

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190814021548.16001-58-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=axboe@kernel.dk \
    --cc=keescook@chromium.org \
    --cc=krp@gtux.in \
    --cc=linux-ide@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Stable Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/stable/0 stable/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 stable stable/ https://lore.kernel.org/stable \
		stable@vger.kernel.org stable@archiver.kernel.org
	public-inbox-index stable


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.stable


AGPL code for this site: git clone https://public-inbox.org/ public-inbox