Message-ID: <1f57bc3d-d125-7e09-4699-0338ddcc50f1@oracle.com>
Date:   Mon, 13 Dec 2021 10:33:51 -0500
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101
 Thunderbird/91.3.2
Content-Language: en-US
To:     damien.lemoal@opensource.wdc.com
Cc:     linux-ide@vger.kernel.org, LKML <linux-kernel@vger.kernel.org>,
        "GEORGE.KENNEDY" <george.kennedy@oracle.com>
From:   George Kennedy <george.kennedy@oracle.com>
Subject: [PATCH RESEND 2] libata: if T_LENGTH is zero, dma direction should be
 DMA_NONE
Organization: Oracle Corporation
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?K1p3L1JnTkNGZ21LcjB4Q2V3UnVWc05RNU1wTDc1eW00VDZLUWxZcXlSck1P?=
 =?utf-8?B?K1JEWlNGMm1VTDVFK1RiY2Y1ei9McS9kWSsxQ094d2VlT0tmSjlES1NLaFVE?=
 =?utf-8?B?VktoMXRzdTlub2lWVzRtL3JOYVJHZXFDN2s0cHkyenc0NGRqMXdKUjBpRjVm?=
 =?utf-8?B?bUdYOTAyVVI4UWkwV0NnemxiNThjZ011bmRBWUd6aUI1bnhib0MwMng0aXBt?=
 =?utf-8?B?K05iUEo5VStOZEdQMkJYSm80SjdXbjdPc3IzdlFYaGdOZWpJZy80TWNpSWMr?=
 =?utf-8?B?Rko4VzYxK0J4WVNxSFc5dElxQXRRcUVSbEpGdjVQa3prbW5RQWN4NjVVRUdo?=
 =?utf-8?B?bTFmOExsbHdKUktNVDlGVGhhRTJzQWFQZDVCMkd4eWZWcVcxSk4zQ1BEbFg5?=
 =?utf-8?B?TXpMRVYyczU4K1JvZ2pLVlIvbERKNXZ2ZDdUMUlxRGVKSWNUNkdEZEdrT0ts?=
 =?utf-8?B?MlhhL3RGZUZjQ1RNbDR2bWp0SUQyZzdibWIwOHpFWHhwS1ZEcGVBK3B4THJG?=
 =?utf-8?B?WWdKSTlCWEl5cEFUN1Y1QzlzWTUyTnVhQ2pwYUF6eFJISnVCVTVwenFQL3Mx?=
 =?utf-8?B?SlNONUVzaVNJZ3pwZHdvUXFQQUZKaVN3YjFvR2E4VEdwdlFjYkVncFRJVHNz?=
 =?utf-8?B?dmtlVlR1WkY1Rk5jdzJHeDRGNEZQQ0hxcVZjbjJQYzBucVh0V2U3ZlROZXcz?=
 =?utf-8?B?RlV3cElLeDJKcUI0dkJRVjJYU1gyYktXV2xOU1doUDRyTG9xK0JwSHBpbThZ?=
 =?utf-8?B?UzZhTTYyYVY5djVwOGNDUnJaV2I2bmRrK1NmcHA0SkVtUERadUNqTXBqTDdh?=
 =?utf-8?B?ZDJMSHE0QnZWcWZsZi9QSVF2WjRaenpuRUM0azBFYXJJczBIckJFV0hDU2NH?=
 =?utf-8?B?bEl3MDg5OUVzNEJmL1ppQU9BSXRCbG1ySHZSRGpVWkFaWmt4L3NoYTR6UGtl?=
 =?utf-8?B?UHJyV2tpaHgyK0ZzSkRvc01GUllld1BnZXp0R2MvTVlPZjZieFl1cloxTi94?=
 =?utf-8?B?U0VFU2duNjUwVldMVkkxRkZFd3NXcnpod0RsS0dLZFNoTS9YRmxiaGpsUElv?=
 =?utf-8?B?QVBJb2xOVDd6NXRiL0JjRjJ4eWhiMkxuT0VySWNPK2VHSUZXMVhZNTY2MWVP?=
 =?utf-8?B?NDIvTEEvSFYyWTY1bjF4R0Y5QmJLQVRoTFRhZzkxeSswTkFySzRNcUY1b2Jz?=
 =?utf-8?B?S0RST0hMTjUrbkNCaGNtSi9VcVJ0Mjk3bWpmdTc3UnZCZjFPVGh0S1RWdVl3?=
 =?utf-8?B?OGF3YmtOSWU5Y2pDRDNGYUptM0xuU0xUZHpiTjVKTGdORndkM1pSNmo3ZGZY?=
 =?utf-8?B?aGVKVVN4TnQ5Y2FKR0xHRm5WMTlaaVN2Yk5jMW1BckdYODgwdm5tRGwzcjNL?=
 =?utf-8?B?cloyV3ZsbC84V3lQL1RVVWMzd1VVUjV4c1JDRzJtQ04vZ0ZEZ2xyZTBaRGFL?=
 =?utf-8?B?VG4zOE9LSzgxclYrSEhXR2xrZDR0c2VGaEhIeUtoTDE4RjhCenhWaUVWWG5S?=
 =?utf-8?B?bUtqMjNQOHVKaHlKRE9HY0x4TnNRYjJnUGg3SFVwR3JweDFKZXQ1dFl0MWw2?=
 =?utf-8?B?OHR2cWVRMEFzbkd5aC9SNDdhVEpCZTFBdU9XZWVHUjdhS0QrQ1Jtamx2QWNz?=
 =?utf-8?B?elZnRlFLV1Ixa0JJRXcwMXBsNm0xdVhpbDhLcUNVM0FFc2VFZ0M4Nk9YWHQ0?=
 =?utf-8?B?L25TaDR3MGxUenp3VlNlaDFhSTk4R1pQL0FhemJHY2dmYTVDeWxncEtITDRX?=
 =?utf-8?B?dDRHSXgvVGMvN2o1MkFnMnpmeGp1b1kzVHFMQ29wQkM4SU52N1lxN1pKa0NR?=
 =?utf-8?B?NXZxTS93d1prVmdFUlViUWJ3eDJ1WVEzZUd1bGltU3I5cytmVy95aW9JQm5w?=
 =?utf-8?B?WGE3V0RraVZ3RE5Bd0dRYjIyKy9WVk9kdVBVcFVVNzMvK3dzNTFQOHBHeHI2?=
 =?utf-8?B?djBKYVloUVpzc2Q1VVdRYUlDdGV0R3NyTHlITHd3MktOenRCcTRkZzl0VzVJ?=
 =?utf-8?B?WUhRS0QrZzlwbmxUM3ZWQVZEa0VUMXNhdVBvN2o3bUkzb1c3N1lkeHdyZ2dG?=
 =?utf-8?B?Z3NqZkJMQlJ0bFRtaS84amQzbDFKTHJybmxEcS80Z0RuR0Via2FHRHhXOUph?=
 =?utf-8?B?cWc4QUlBdFdwQ2JaR2xwVm1xTDRCOU5xdUg1dWpxaE00ZFZTbi9XN1k2RFBl?=
 =?utf-8?B?dnlvQldrVU96eDBkemZLME1TTTlDYm9KUi9pMDZpZXhFWjFqNlZKM0xocFc5?=
 =?utf-8?B?R3dEQU5EeXJ6SEFaRDVBS1dkRU9BPT0=?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: b1552b29-2353-4743-03e2-08d9be4df99e
X-MS-Exchange-CrossTenant-AuthSource: BN0PR10MB5192.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Dec 2021 15:33:56.0995
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: tAABRD5zvUcex+j8bTj0tk5/oINOk5Qq7hfw/qM0PfqjXLMuX7QC8qWlwnonAFrmENBzE6STgMbImUvadQhHFRB7UhZskHOZr2GNfeOEX9I=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN7PR10MB2561
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10196 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 adultscore=0 suspectscore=0
 mlxlogscore=999 phishscore=0 malwarescore=0 bulkscore=0 mlxscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000
 definitions=main-2112130099
X-Proofpoint-GUID: CLpq3mzThK8_qUoLdebsjkUlQw5G-f4S
X-Proofpoint-ORIG-GUID: CLpq3mzThK8_qUoLdebsjkUlQw5G-f4S
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Avoid data corruption by rejecting pass-through commands where
T_LENGTH is zero (No data is transferred) and the dma direction
is not DMA_NONE.

Cc:<stable@vger.kernel.org>  # 5.4.y
Reported-by: syzkaller<syzkaller@googlegroups.com>
Signed-off-by: George Kennedy<george.kennedy@oracle.com>
---
  drivers/ata/libata-scsi.c | 6 ++++++
  1 file changed, 6 insertions(+)

diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 1b84d55..d428392 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -2859,6 +2859,12 @@ static unsigned int ata_scsi_pass_thru(struct ata_queued_cmd *qc)
  		goto invalid_fld;
  	}
  
+	/* if T_LENGTH is zero (No data is transferred), then dir should be DMA_NONE */
+	if ((cdb[2 + cdb_offset] & 3) == 0 && scmd->sc_data_direction != DMA_NONE) {
+		fp = 2 + cdb_offset;
+		goto invalid_fld;
+	}
+
  	if (ata_is_ncq(tf->protocol) && (cdb[2 + cdb_offset] & 0x3) == 0)
  		tf->protocol = ATA_PROT_NCQ_NODATA;
  
-- 1.8.3.1