a8f8cf8705
commit 6e74e53b34b6dec5a50e1404e2680852ec6768d2 upstream. reveliofuzzing reported that a SCSI_IOCTL_SEND_COMMAND ioctl with out_len set to 0xd42, SCSI command set to ATA_16 PASS-THROUGH, ATA command set to ATA_NOP, and protocol set to ATA_PROT_PIO, can cause ata_pio_sector() to write outside the allocated buffer, overwriting random memory. While a ATA device is supposed to abort a ATA_NOP command, there does seem to be a bug either in libata-sff or QEMU, where either this status is not set, or the status is cleared before read by ata_sff_hsm_move(). Anyway, that is most likely a separate bug. Looking at __atapi_pio_bytes(), it already has a safety check to ensure that __atapi_pio_bytes() cannot write outside the allocated buffer. Add a similar check to ata_pio_sector(), such that also ata_pio_sector() cannot write outside the allocated buffer. Cc: stable@vger.kernel.org Reported-by: reveliofuzzing <reveliofuzzing@gmail.com> Closes: https://lore.kernel.org/linux-ide/CA+-ZZ_jTgxh3bS7m+KX07_EWckSnW3N2adX3KV63y4g7M4CZ2A@mail.gmail.com/ Link: https://lore.kernel.org/r/20250127154303.15567-2-cassel@kernel.org Signed-off-by: Niklas Cassel <cassel@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|---|---|---|
| .. | ||
| acard-ahci.c | ||
| ahci_brcm.c | ||
| ahci_ceva.c | ||
| ahci_da850.c | ||
| ahci_dm816.c | ||
| ahci_dwc.c | ||
| ahci_imx.c | ||
| ahci_mtk.c | ||
| ahci_mvebu.c | ||
| ahci_octeon.c | ||
| ahci_platform.c | ||
| ahci_qoriq.c | ||
| ahci_seattle.c | ||
| ahci_st.c | ||
| ahci_sunxi.c | ||
| ahci_tegra.c | ||
| ahci_xgene.c | ||
| ahci.c | ||
| ahci.h | ||
| ata_generic.c | ||
| ata_piix.c | ||
| Kconfig | ||
| libahci_platform.c | ||
| libahci.c | ||
| libata-acpi.c | ||
| libata-core.c | ||
| libata-eh.c | ||
| libata-pata-timings.c | ||
| libata-pmp.c | ||
| libata-sata.c | ||
| libata-scsi.c | ||
| libata-sff.c | ||
| libata-trace.c | ||
| libata-transport.c | ||
| libata-transport.h | ||
| libata-zpodd.c | ||
| libata.h | ||
| Makefile | ||
| pata_acpi.c | ||
| pata_ali.c | ||
| pata_amd.c | ||
| pata_arasan_cf.c | ||
| pata_artop.c | ||
| pata_atiixp.c | ||
| pata_atp867x.c | ||
| pata_bk3710.c | ||
| pata_buddha.c | ||
| pata_cmd64x.c | ||
| pata_cmd640.c | ||
| pata_cs5520.c | ||
| pata_cs5530.c | ||
| pata_cs5535.c | ||
| pata_cs5536.c | ||
| pata_cypress.c | ||
| pata_efar.c | ||
| pata_ep93xx.c | ||
| pata_falcon.c | ||
| pata_ftide010.c | ||
| pata_gayle.c | ||
| pata_hpt3x2n.c | ||
| pata_hpt3x3.c | ||
| pata_hpt37x.c | ||
| pata_hpt366.c | ||
| pata_icside.c | ||
| pata_imx.c | ||
| pata_isapnp.c | ||
| pata_it821x.c | ||
| pata_it8213.c | ||
| pata_ixp4xx_cf.c | ||
| pata_jmicron.c | ||
| pata_legacy.c | ||
| pata_macio.c | ||
| pata_marvell.c | ||
| pata_mpc52xx.c | ||
| pata_mpiix.c | ||
| pata_netcell.c | ||
| pata_ninja32.c | ||
| pata_ns87410.c | ||
| pata_ns87415.c | ||
| pata_octeon_cf.c | ||
| pata_of_platform.c | ||
| pata_oldpiix.c | ||
| pata_opti.c | ||
| pata_optidma.c | ||
| pata_palmld.c | ||
| pata_pcmcia.c | ||
| pata_pdc202xx_old.c | ||
| pata_pdc2027x.c | ||
| pata_piccolo.c | ||
| pata_platform.c | ||
| pata_pxa.c | ||
| pata_radisys.c | ||
| pata_rb532_cf.c | ||
| pata_rdc.c | ||
| pata_rz1000.c | ||
| pata_samsung_cf.c | ||
| pata_sc1200.c | ||
| pata_sch.c | ||
| pata_serverworks.c | ||
| pata_sil680.c | ||
| pata_sis.c | ||
| pata_sl82c105.c | ||
| pata_triflex.c | ||
| pata_via.c | ||
| pdc_adma.c | ||
| sata_dwc_460ex.c | ||
| sata_fsl.c | ||
| sata_gemini.c | ||
| sata_gemini.h | ||
| sata_highbank.c | ||
| sata_inic162x.c | ||
| sata_mv.c | ||
| sata_nv.c | ||
| sata_promise.c | ||
| sata_promise.h | ||
| sata_qstor.c | ||
| sata_rcar.c | ||
| sata_sil24.c | ||
| sata_sil.c | ||
| sata_sis.c | ||
| sata_svw.c | ||
| sata_sx4.c | ||
| sata_uli.c | ||
| sata_via.c | ||
| sata_vsc.c | ||
| sis.h | ||