From:   George Kennedy <george.kennedy@oracle.com>
To:     gregkh@linuxfoundation.org, damien.lemoal@opensource.wdc.com
Cc:     george.kennedy@oracle.com, linux-ide@vger.kernel.org,
        linux-kernel@vger.kernel.org
Subject: [PATCH] libata: if T_LENGTH is zero, dma direction should be DMA_NONE
Date:   Thu,  9 Dec 2021 10:00:20 -0500
Message-Id: <1639062020-5621-1-git-send-email-george.kennedy@oracle.com>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?id969QtZdnLyF0DJuwoW2oGuthR7E03mJ2gGDVi/0VZARao8JrfQx7AlUieV?=
 =?us-ascii?Q?4G5qvjwIYF5/qV8x/5q5C+eM4H3Qx8hp+96cedGVK82w20xgYqk87NhUjRTB?=
 =?us-ascii?Q?rSKHPIMhk/sy5Y2jOreNTBBpdEdSnvBQBZtcOkMFn/p4jcWR+dqQoAYFH7UE?=
 =?us-ascii?Q?A6AZtM+YXmk14jZ+v7lj580XhaeVihsuqn7bGv2MLXKAVCIBMU7QJmeFWI6N?=
 =?us-ascii?Q?QrSPsazp5xKQFCjtv8Gf0K2bmCjWjuczszM2dP+U3Uo072Csq/F3Cts1o3Hy?=
 =?us-ascii?Q?6I9KobEiKS8uz9QDHDDI2AFIpt9F9OiYUQQyDU/h8HLJX7RywVv8hoDqA817?=
 =?us-ascii?Q?Igmxf1g79phGIo5Rh+lzM3GepJJqopuaNxI6FRmywc+T6nesr+fX6Yancr6j?=
 =?us-ascii?Q?o36sqsX02UUMgNDTRC+TWU83/PO9mU8nOweUQb/xzwThrvomdtKstFdhykDB?=
 =?us-ascii?Q?kE2Swhe+3g9ynyrNfDj1Yt0/S3Iph2WQ7ZWly3DJowAXQE+1CADo1S38yUd+?=
 =?us-ascii?Q?bMYERDiRZ+njM0jjXvThs95lC9xGtFgiegkX3p8DPbyu2hIRk8CghcasWe03?=
 =?us-ascii?Q?vpnqJss2/kkJ9BE8DBP1M1n9jGXOH36zWFUH6LSnHxZjuHU1JBgLxJh2RpW2?=
 =?us-ascii?Q?/DkduVhjOLAy127nXT2nn47yqRuzcEzidJ+TjBaxqGaTgx+qha9Z+xbxBxYX?=
 =?us-ascii?Q?1Te22H18OAXw6edeJeljsFI+8fucNJpHTWUhgFdLJl8Do4k4N1Jdx1YW5Nk5?=
 =?us-ascii?Q?tQBkrVnrk4CE5fT3J98pWAPImQZJKlkqpA5phWo7svV+TkZWgouaGtL9+DK+?=
 =?us-ascii?Q?TK4p92ZWVYf0vezSEsagR7AOim4NC6Ad5b0bBU5/bc8oX4m+7Vqpm3cDocSg?=
 =?us-ascii?Q?V9a/eq5+eCm/+4UtnbqKKy6pB31CY/rDgYhrGr9Bj5ZSM4DVMpMff1mWCUAI?=
 =?us-ascii?Q?N93uDxh4Xbd911GbwljIVVfeh8t0coJfmooYPNJ2QT3ciXZXNbbaXQ8LQ7Wl?=
 =?us-ascii?Q?J0U4LnIU45bEIOpPWPVuCv5PBzc4FWxJmDbnZXrYwvHk989l2ZV06M1ryRQ8?=
 =?us-ascii?Q?b42BW13XMYTw0HHeRThU31YBPcvtqRGWTnKsVWIxSDoTgH614y7VbVy557Lp?=
 =?us-ascii?Q?AwFVsc4gMGUyfQjU90LmVWHdfYNVvGz24XPuNO7BUda1BiZ0wEbkU8Lm0ZdT?=
 =?us-ascii?Q?VccKARmMMD/Y4cdbG9t9YT2OhknZqE8wc2y+b9vDo3fwkUCIgLozq0eNnAQ9?=
 =?us-ascii?Q?OqOrDBDF0DV6LtZMWM1nnZbBrhVkJwprx97L9+2dxHMBhgYsC0PwyBav96Xe?=
 =?us-ascii?Q?M7MozIw0w0/t2aOHfWEazeQDUPiJNMtmcG0Rf2xE3PzwthAC75DNaea8MpDY?=
 =?us-ascii?Q?E/jjpeS7+Ca4FlTDw9IgCgLs/q83K4ovrBQmkIFQ/VaNI6nb4A1MkB2vOEaW?=
 =?us-ascii?Q?d4vA7zJh6XKAMjbqweFVs2I9W7FCvBtPDWKdvNHtEbvlyG5AY1Pv6iYToBjY?=
 =?us-ascii?Q?fryjOo8TUvJ0+iG+IpvKHsuAVrRvh0OpMAhQucs9iNZKpDhadxOeeaYIvphi?=
 =?us-ascii?Q?XM5RKyioYg4jpvhAeYfdta8RNEm4lm3fSz8ef+LN00GcCwdSvthZPzBZ49Ts?=
 =?us-ascii?Q?RUGS/mopw14nCksFgqmTldmlT1S/Gbkt2lEH0R4nlFxHk/A6H2StWgscAYY+?=
 =?us-ascii?Q?/vHmwg=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 1ba193f3-9331-4e0b-267e-08d9bb24e511
X-MS-Exchange-CrossTenant-AuthSource: BN0PR10MB5192.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Dec 2021 15:02:18.8783
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 8R5PcskPSLpfxEq3m/mZcMzc4cOCs7VDhX95osvEfLCcxLYtKvRLvFQmq6Ei2FZjzFxUAh5xkgOtb/foqpNE/E7jo8noL0Zra3wv9fRR5TM=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN8PR10MB3282
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10192 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxlogscore=985 mlxscore=0 spamscore=0
 phishscore=0 bulkscore=0 suspectscore=0 malwarescore=0 adultscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000
 definitions=main-2112090081
X-Proofpoint-GUID: 99cPqNwqlPQdBoyBxe9FrmgDZI9nMQaP
X-Proofpoint-ORIG-GUID: 99cPqNwqlPQdBoyBxe9FrmgDZI9nMQaP
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Avoid data corruption by rejecting pass-through commands where
T_LENGTH is zero (No data is transferred) and the dma direction
is not DMA_NONE.

Reported-by: syzkaller <syzkaller@googlegroups.com>
Signed-off-by: George Kennedy <george.kennedy@oracle.com>
---
 drivers/ata/libata-scsi.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 1b84d55..d428392 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -2859,6 +2859,12 @@ static unsigned int ata_scsi_pass_thru(struct ata_queued_cmd *qc)
 		goto invalid_fld;
 	}
 
+	/* if T_LENGTH is zero (No data is transferred), then dir should be DMA_NONE */
+	if ((cdb[2 + cdb_offset] & 3) == 0 && scmd->sc_data_direction != DMA_NONE) {
+		fp = 2 + cdb_offset;
+		goto invalid_fld;
+	}
+
 	if (ata_is_ncq(tf->protocol) && (cdb[2 + cdb_offset] & 0x3) == 0)
 		tf->protocol = ATA_PROT_NCQ_NODATA;
 
-- 
1.8.3.1