From:   George Kennedy <george.kennedy@oracle.com>
To:     damien.lemoal@opensource.wdc.com
Cc:     george.kennedy@oracle.com, linux-ide@vger.kernel.org,
        linux-kernel@vger.kernel.org, stable@vger.kernel.org
Subject: [PATCH RESEND] libata: if T_LENGTH is zero, dma direction should be DMA_NONE
Date:   Mon, 13 Dec 2021 10:09:24 -0500
Message-Id: <1639408164-4210-1-git-send-email-george.kennedy@oracle.com>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?mcDHww3MQtMaLPeZb1isR3JCV7z21LqLkdjy/NFD1Q/EYWqwqTjgvk9ZfoOJ?=
 =?us-ascii?Q?H+V4VncHbW6Jy+KNj3VQVd9imvnMhLcYNr8xKMVgqySojjWa3DBvcnmCNyeO?=
 =?us-ascii?Q?iIeLwOljeNScLCGuPsn3Q/ZXK7C9lAr2Qz3wV7A7es2UcE/r5SOCfdGTjMhM?=
 =?us-ascii?Q?3NkHxP34oVcSny4Fix1QdKleF7a6FVeGDJd8676uRm2L6pxjcdClWE8yC4vY?=
 =?us-ascii?Q?jbAnP55K8TJyOg1oQdpxWjXEqRapiY0ulaL4MQwh/Ia3sw4Sfwd4zVTd7P1M?=
 =?us-ascii?Q?Q/nHuuoK6BOuSr5XVnWv4QeW1zOpdTRwdiFe756J+yUnfmNlWyrV0yCTNLYT?=
 =?us-ascii?Q?AYZ4i7IXgxJk4z+50eRtT6OO08Sw6Ff7Znme3jVtsrwvXZVWOKYaUrTtIlYn?=
 =?us-ascii?Q?f5ls3Y+W0O6LWpC56rSlNvbbsX7wwKM5z4jj3Y8SNtsFcSt5VCw/sSu+FfyB?=
 =?us-ascii?Q?urhdyAdoTvYIUwuRACe2OLr8q28qFSMSgd4pzPhNLogNkO/2Nd+Fv2aUCemK?=
 =?us-ascii?Q?3hhAaoGtHYpjuNG0+GQL0rPVZvyxKc77BiaYEuY/KCx82YBQqRAGVjdmfd24?=
 =?us-ascii?Q?C3RjB/TYF29KgobIblDW4O9pM1V96F2J5sSL/7QFgGSScDipK3rx/E59tn13?=
 =?us-ascii?Q?6FjhDqjtECUy0YKqZcdW5uT2eX7LKaHhFuKTkVAzL6k7VggFSk5+mCbzHO4B?=
 =?us-ascii?Q?OqoN3scUKjw5eHlD6Nr7rYAsdj+i6aH7juk6V2Ie2nEEegxRENQUI+1z4aU3?=
 =?us-ascii?Q?VZWPUTDVnxQcfEYhBAieK1VyC1gahZI3fNMQF+WEopHcTE47ABSmGPoVCdIp?=
 =?us-ascii?Q?5TSW27GSZCX8xAl8r96zBRnPYCpAUxKSwGAewrt1LfQub2Gib7qZK052RFgc?=
 =?us-ascii?Q?Q0oaSNfa+gZfJSmRZ12s8eq5+EufBmvH0j2/hpIKIaIDa3oesBnimxyfKQDr?=
 =?us-ascii?Q?JyB33dmBDI8z3Ibvux3hZqwElHqr3Y/iNek+foLjVFwW4XAdFnxcOfL7AFlk?=
 =?us-ascii?Q?Njxp6kWC09d570SPwMx5ZIRHS4B6g8MDskrVUtIBS0VRTGPiba6KMAzbMXAU?=
 =?us-ascii?Q?hy5v7sdmo7IJtmqV6xSuvDI9kkE2bWhMaxeZg1fuxQHVYrIuchrD73hlzZWH?=
 =?us-ascii?Q?5n4YC0ZRnf/6DM4Ye6nVRu++wpG7XxNqvgJ/YA1GU7ynH3lIdKMI/q5t7KgV?=
 =?us-ascii?Q?tOSRIzaUr3GcVqfLqrnEcQXH/IrcU5GKqNv8Vy5Fp9GCH8f4Tc1ms1k7RJ/C?=
 =?us-ascii?Q?JCMzr2UQZN+myryzxWzPIOHoXKx948ovHR/yAhWNBJH5pYrJEvWLCkt2Ip2E?=
 =?us-ascii?Q?yoDnp/xkqfxKrm1HQGFGcrNjpkCqFQyNVa4s/yTrvwXnTScdaKV92oMmwuEr?=
 =?us-ascii?Q?JTeZHkMFn0/h4vRsN9JzBBuLwF205i2f9VQw2Een+UZGUIef4Xc91HDjc+OW?=
 =?us-ascii?Q?g4XteBcyj8jC0xuPT3OUoZkNfHUGGobQfN/b9jw9r6w73gTOPOK9Jet0mc1z?=
 =?us-ascii?Q?f4aW+RQDtzJe60ch18uoJZpW19xmrPxdSwjG2cc++6+qDH/ZWXA1Qtw7xvUm?=
 =?us-ascii?Q?fo7/8P3chtf+IKzu3bfSGLcgjC3Hp4Xwzdpeflcp04zwDU0/sMtZ/Mo3yMnJ?=
 =?us-ascii?Q?xj6Up++dbAvR/xAoyyYdDKX9t+ZxUsPAjFIlZ3U0tgbVtFP4CFaEhmzgMBhG?=
 =?us-ascii?Q?22bukQ=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 6399f004-2965-4495-8d89-08d9be4ad272
X-MS-Exchange-CrossTenant-AuthSource: BN0PR10MB5192.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Dec 2021 15:11:21.8621
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 3mXdtfAWnxzqb/tNgqnNUiw/6mEKx/GLEaZXfZDwrW8MJrev9+a6U78NC9+p4SQogT/XYFJXQI+aML8REZ1mNwFG4b2IWNNEORyEhE001dE=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN7PR10MB2564
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10196 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 phishscore=0 spamscore=0 suspectscore=0
 malwarescore=0 mlxlogscore=974 bulkscore=0 mlxscore=0 adultscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000
 definitions=main-2112130097
X-Proofpoint-GUID: sZN4a20NpPEhBImvFVM_EgZafLZGSOoG
X-Proofpoint-ORIG-GUID: sZN4a20NpPEhBImvFVM_EgZafLZGSOoG
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Avoid data corruption by rejecting pass-through commands where
T_LENGTH is zero (No data is transferred) and the dma direction
is not DMA_NONE.

Reported-by: syzkaller <syzkaller@googlegroups.com>
Signed-off-by: George Kennedy <george.kennedy@oracle.com>
---
 drivers/ata/libata-scsi.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 1b84d55..d428392 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -2859,6 +2859,12 @@ static unsigned int ata_scsi_pass_thru(struct ata_queued_cmd *qc)
 		goto invalid_fld;
 	}
 
+	/* if T_LENGTH is zero (No data is transferred), then dir should be DMA_NONE */
+	if ((cdb[2 + cdb_offset] & 3) == 0 && scmd->sc_data_direction != DMA_NONE) {
+		fp = 2 + cdb_offset;
+		goto invalid_fld;
+	}
+
 	if (ata_is_ncq(tf->protocol) && (cdb[2 + cdb_offset] & 0x3) == 0)
 		tf->protocol = ATA_PROT_NCQ_NODATA;
 
-- 
1.8.3.1