From: Sasha Levin <sashal@kernel.org> To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Jens Axboe <axboe@kernel.dk>, Krishna Ram Prakash R <krp@gtux.in>, Kees Cook <keescook@chromium.org>, Sasha Levin <sashal@kernel.org>, linux-ide@vger.kernel.org Subject: [PATCH AUTOSEL 4.14 37/44] libata: have ata_scsi_rw_xlat() fail invalid passthrough requests Date: Tue, 13 Aug 2019 22:18:26 -0400 Message-ID: <20190814021834.16662-37-sashal@kernel.org> (raw) In-Reply-To: <20190814021834.16662-1-sashal@kernel.org> From: Jens Axboe <axboe@kernel.dk> [ Upstream commit 2d7271501720038381d45fb3dcbe4831228fc8cc ] For passthrough requests, libata-scsi takes what the user passes in as gospel. This can be problematic if the user fills in the CDB incorrectly. One example of that is in request sizes. For read/write commands, the CDB contains fields describing the transfer length of the request. These should match with the SG_IO header fields, but libata-scsi currently does no validation of that. Check that the number of blocks in the CDB for passthrough requests matches what was mapped into the request. If the CDB asks for more data then the validated SG_IO header fields, error it. Reported-by: Krishna Ram Prakash R <krp@gtux.in> Reviewed-by: Kees Cook <keescook@chromium.org> Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Sasha Levin <sashal@kernel.org> --- drivers/ata/libata-scsi.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c index bf5777bc04d35..eb0c4ee205258 100644 --- a/drivers/ata/libata-scsi.c +++ b/drivers/ata/libata-scsi.c @@ -1804,6 +1804,21 @@ static unsigned int ata_scsi_verify_xlat(struct ata_queued_cmd *qc) return 1; } +static bool ata_check_nblocks(struct scsi_cmnd *scmd, u32 n_blocks) +{ + struct request *rq = scmd->request; + u32 req_blocks; + + if (!blk_rq_is_passthrough(rq)) + return true; + + req_blocks = blk_rq_bytes(rq) / scmd->device->sector_size; + if (n_blocks > req_blocks) + return false; + + return true; +} + /** * ata_scsi_rw_xlat - Translate SCSI r/w command into an ATA one * @qc: Storage for translated ATA taskfile @@ -1848,6 +1863,8 @@ static unsigned int ata_scsi_rw_xlat(struct ata_queued_cmd *qc) scsi_10_lba_len(cdb, &block, &n_block); if (cdb[1] & (1 << 3)) tf_flags |= ATA_TFLAG_FUA; + if (!ata_check_nblocks(scmd, n_block)) + goto invalid_fld; break; case READ_6: case WRITE_6: @@ -1862,6 +1879,8 @@ static unsigned int ata_scsi_rw_xlat(struct ata_queued_cmd *qc) */ if (!n_block) n_block = 256; + if (!ata_check_nblocks(scmd, n_block)) + goto invalid_fld; break; case READ_16: case WRITE_16: @@ -1872,6 +1891,8 @@ static unsigned int ata_scsi_rw_xlat(struct ata_queued_cmd *qc) scsi_16_lba_len(cdb, &block, &n_block); if (cdb[1] & (1 << 3)) tf_flags |= ATA_TFLAG_FUA; + if (!ata_check_nblocks(scmd, n_block)) + goto invalid_fld; break; default: DPRINTK("no-byte command\n"); -- 2.20.1
next prev parent reply index Thread overview: 45+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-08-14 2:17 [PATCH AUTOSEL 4.14 01/44] iio: adc: max9611: Fix misuse of GENMASK macro Sasha Levin 2019-08-14 2:17 ` [PATCH AUTOSEL 4.14 02/44] HID: Add 044f:b320 ThrustMaster, Inc. 2 in 1 DT Sasha Levin 2019-08-14 2:17 ` [PATCH AUTOSEL 4.14 03/44] MIPS: kernel: only use i8253 clocksource with periodic clockevent Sasha Levin 2019-08-14 2:17 ` [PATCH AUTOSEL 4.14 04/44] mips: fix cacheinfo Sasha Levin 2019-08-14 2:17 ` [PATCH AUTOSEL 4.14 05/44] netfilter: ebtables: fix a memory leak bug in compat Sasha Levin 2019-08-14 2:17 ` [PATCH AUTOSEL 4.14 06/44] ASoC: dapm: Fix handling of custom_stop_condition on DAPM graph walks Sasha Levin 2019-08-14 2:17 ` [PATCH AUTOSEL 4.14 07/44] bonding: Force slave speed check after link state recovery for 802.3ad Sasha Levin 2019-08-14 2:17 ` [PATCH AUTOSEL 4.14 08/44] can: dev: call netif_carrier_off() in register_candev() Sasha Levin 2019-08-14 2:17 ` [PATCH AUTOSEL 4.14 09/44] ASoC: Fail card instantiation if DAI format setup fails Sasha Levin 2019-08-14 2:17 ` [PATCH AUTOSEL 4.14 10/44] st21nfca_connectivity_event_received: null check the allocation Sasha Levin 2019-08-14 2:18 ` [PATCH AUTOSEL 4.14 11/44] st_nci_hci_connectivity_event_received: " Sasha Levin 2019-08-14 2:18 ` [PATCH AUTOSEL 4.14 12/44] ASoC: ti: davinci-mcasp: Correct slot_width posed constraint Sasha Levin 2019-08-14 2:18 ` [PATCH AUTOSEL 4.14 13/44] net: usb: qmi_wwan: Add the BroadMobi BM818 card Sasha Levin 2019-08-14 2:18 ` [PATCH AUTOSEL 4.14 14/44] qed: RDMA - Fix the hw_ver returned in device attributes Sasha Levin 2019-08-14 2:18 ` [PATCH AUTOSEL 4.14 15/44] isdn: mISDN: hfcsusb: Fix possible null-pointer dereferences in start_isoc_chain() Sasha Levin 2019-08-14 2:18 ` [PATCH AUTOSEL 4.14 16/44] netfilter: ipset: Fix rename concurrency with listing Sasha Levin 2019-08-14 2:18 ` [PATCH AUTOSEL 4.14 17/44] netfilter: ebtables: also count base chain policies Sasha Levin 2019-08-14 2:18 ` [PATCH AUTOSEL 4.14 18/44] driver core: Fix use-after-free and double free on glue directory Sasha Levin 2019-08-14 7:37 ` Greg Kroah-Hartman 2019-08-14 2:18 ` [PATCH AUTOSEL 4.14 19/44] isdn: hfcsusb: Fix mISDN driver crash caused by transfer buffer on the stack Sasha Levin 2019-08-14 2:18 ` [PATCH AUTOSEL 4.14 20/44] perf bench numa: Fix cpu0 binding Sasha Levin 2019-08-14 2:18 ` [PATCH AUTOSEL 4.14 21/44] Input: kbtab - sanity check for endpoint type Sasha Levin 2019-08-14 2:18 ` [PATCH AUTOSEL 4.14 22/44] net: usb: pegasus: fix improper read if get_registers() fail Sasha Levin 2019-08-14 2:18 ` [PATCH AUTOSEL 4.14 23/44] can: sja1000: force the string buffer NULL-terminated Sasha Levin 2019-08-14 2:18 ` [PATCH AUTOSEL 4.14 24/44] can: peak_usb: " Sasha Levin 2019-08-14 2:18 ` [PATCH AUTOSEL 4.14 25/44] net/ethernet/qlogic/qed: " Sasha Levin 2019-08-14 2:18 ` [PATCH AUTOSEL 4.14 26/44] NFSv4: Fix a potential sleep while atomic in nfs4_do_reclaim() Sasha Levin 2019-08-14 2:18 ` [PATCH AUTOSEL 4.14 27/44] HID: holtek: test for sanity of intfdata Sasha Levin 2019-08-14 2:18 ` [PATCH AUTOSEL 4.14 28/44] HID: input: fix a4tech horizontal wheel custom usage Sasha Levin 2019-08-14 2:18 ` [PATCH AUTOSEL 4.14 29/44] SMB3: Kernel oops mounting a encryptData share with CONFIG_DEBUG_VIRTUAL Sasha Levin 2019-08-14 2:18 ` [PATCH AUTOSEL 4.14 30/44] HID: hiddev: avoid opening a disconnected device Sasha Levin 2019-08-14 2:18 ` [PATCH AUTOSEL 4.14 31/44] HID: hiddev: do cleanup in failure of opening a device Sasha Levin 2019-08-14 2:18 ` [PATCH AUTOSEL 4.14 32/44] Input: iforce - add sanity checks Sasha Levin 2019-08-14 2:18 ` [PATCH AUTOSEL 4.14 33/44] net: cxgb3_main: Fix a resource leak in a error path in 'init_one()' Sasha Levin 2019-08-14 2:18 ` [PATCH AUTOSEL 4.14 34/44] net: hisilicon: make hip04_tx_reclaim non-reentrant Sasha Levin 2019-08-14 2:18 ` [PATCH AUTOSEL 4.14 35/44] net: hisilicon: fix hip04-xmit never return TX_BUSY Sasha Levin 2019-08-14 2:18 ` [PATCH AUTOSEL 4.14 36/44] net: hisilicon: Fix dma_map_single failed on arm64 Sasha Levin 2019-08-14 2:18 ` Sasha Levin [this message] 2019-08-14 2:18 ` [PATCH AUTOSEL 4.14 38/44] libata: add SG safety checks in SFF pio transfers Sasha Levin 2019-08-14 2:18 ` [PATCH AUTOSEL 4.14 39/44] x86/lib/cpu: Address missing prototypes warning Sasha Levin 2019-08-14 2:18 ` [PATCH AUTOSEL 4.14 40/44] drm/vmwgfx: fix memory leak when too many retries have occurred Sasha Levin 2019-08-14 2:18 ` [PATCH AUTOSEL 4.14 41/44] perf ftrace: Fix failure to set cpumask when only one cpu is present Sasha Levin 2019-08-14 2:18 ` [PATCH AUTOSEL 4.14 42/44] perf cpumap: Fix writing to illegal memory in handling cpumap mask Sasha Levin 2019-08-14 2:18 ` [PATCH AUTOSEL 4.14 43/44] perf pmu-events: Fix missing "cpu_clk_unhalted.core" event Sasha Levin 2019-08-14 2:18 ` [PATCH AUTOSEL 4.14 44/44] selftests: kvm: Adding config fragments Sasha Levin
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20190814021834.16662-37-sashal@kernel.org \ --to=sashal@kernel.org \ --cc=axboe@kernel.dk \ --cc=keescook@chromium.org \ --cc=krp@gtux.in \ --cc=linux-ide@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=stable@vger.kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
Stable Archive on lore.kernel.org Archives are clonable: git clone --mirror https://lore.kernel.org/stable/0 stable/git/0.git # If you have public-inbox 1.1+ installed, you may # initialize and index your mirror using the following commands: public-inbox-init -V2 stable stable/ https://lore.kernel.org/stable \ stable@vger.kernel.org public-inbox-index stable Example config snippet for mirrors Newsgroup available over NNTP: nntp://nntp.lore.kernel.org/org.kernel.vger.stable AGPL code for this site: git clone https://public-inbox.org/public-inbox.git