Message-ID: <e3ff85bc-bf01-c90d-298f-4cbd30b460c1@oracle.com>
Date:   Mon, 13 Dec 2021 17:15:57 -0500
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101
 Thunderbird/91.3.2
Subject: Re: [PATCH RESEND 2] libata: if T_LENGTH is zero, dma direction
 should be DMA_NONE
Content-Language: en-US
To:     Damien Le Moal <damien.lemoal@opensource.wdc.com>
Cc:     linux-ide@vger.kernel.org, LKML <linux-kernel@vger.kernel.org>
References: <1f57bc3d-d125-7e09-4699-0338ddcc50f1@oracle.com>
 <c6212443-e40a-2813-1920-905e89884204@opensource.wdc.com>
From:   George Kennedy <george.kennedy@oracle.com>
Organization: Oracle Corporation
In-Reply-To: <c6212443-e40a-2813-1920-905e89884204@opensource.wdc.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?bS9sbWc4dUpkUGFhYTczV0lpR1FHZzNXbzM2MnI1b0pEbU1hY0d6bld6OVpm?=
 =?utf-8?B?M0FxUU1wVTY4V3JJckh3OCtzSkFJZTJlRVViSVgrOUVhWFcvVDczODRKenc3?=
 =?utf-8?B?QmUxYUFRTldxS1Zlb3laS2FvRnA5RnNvYmxBMkVFeWhFRkJ0WjllRUppdVlu?=
 =?utf-8?B?NTIxZlNzdU1IV0hJWUtoSWtKVDJlVlc5T1QwSldhWDBrNjVDQ21ya2JEZGR6?=
 =?utf-8?B?ejdsYUt5Yzg4cjlGQ2FoY0p0WGtaVG9tTC9KN29pQ3pyVUwxZm5YOXJGSXVT?=
 =?utf-8?B?clN5RWVRRGRiUitpS284U2ZGVzJJUHNqNGdoN2VtU3NQRXN3bFFKTC9XT3RX?=
 =?utf-8?B?d1QrZk5wcFNTaEduK1JmZEk1QVFqNXAyRWxSY1JPV2xaeWIwdG92aGNsTmRv?=
 =?utf-8?B?R1dOOFZxTmlYWk5PT25QTGw2U3NpOGNHbWhJeWw3MWxCeWlCVEczaS8rQUZo?=
 =?utf-8?B?ZEZmQ0ZCajYvRHZZZFF3RlhJZUp6ZkVGVklFOGc4MlBUcEpJSUJ0eWdqcFhO?=
 =?utf-8?B?TSsyY3M3V05GNGI5eElpcEJPOFd6a0RqYjMrSlNmc1dVYnp3bWEwbTlSRFN3?=
 =?utf-8?B?ZXQ3RTRzTWt0SldDLzVycFdVZ1RSS1l6ZmRPS3hsYkppTGtYNUJVWXpnT3Ux?=
 =?utf-8?B?SFAwZGcxWmtyd1k3VDY2dDVwNERIY2ZQQ01PeHNCZTVaVjkrUkhuRll6Um53?=
 =?utf-8?B?c1VVV2pNcXhBYW5xejRIaGhqd0VXQzIzRHp1V1lBWG9pdnBMWW1Qd21PTVpa?=
 =?utf-8?B?eSttOE5Jc3lIZGtWdlRnRGJrb29jbnlTNlNISkQzMmdETnlrcDZaYUovZmNG?=
 =?utf-8?B?UjQ0R1Z5cDVYbVdRVVdpOU1aeWFscGNyeituRUpLMnhUZ3pNWXBhZE40cmFi?=
 =?utf-8?B?Q2NIanh6UVBsSzY1WjhPQkExZXZIbmhiTWpFRjBDbHF0SFlrVlRwQnNvOTFY?=
 =?utf-8?B?SEZLeTBUOCtZalU2dU1oN0pSWnd0Z0o2NTFYc3Fycnc4V2hmRTN2bmxRcmg0?=
 =?utf-8?B?QTFEcm9UU0N5YXpaazNwWmlzKzZ1TGxHUnVySHJ5NnFEaHVtNWFTVm9QU3hy?=
 =?utf-8?B?WDVkTWRManZtTkZPeXlJNGFieTZsTHlYNXRpQmFMMHZLVlRKSXB5bG95amVz?=
 =?utf-8?B?WXd5dloyUDlxSHBKRTZscHFYUVkzSVBLZDRmOUtsRllJR2JTbHlQTWgvak1r?=
 =?utf-8?B?d0IrT3lONkFqcnFUREh3Y0p4cDZpNlhVcXR4NnZPOFpVL0dHN3poMC9kb0NQ?=
 =?utf-8?B?clVxNW5rSytHcW9OU0JKazNnekNUWWQwWCt0b2ZqeEZuNnFSWGliS2NrSnJx?=
 =?utf-8?B?bE0vcUpSZGhYZHl1ZWdTbTAySy9sYTZQNE1NbkNTVE1iTGVyZVdHODBXLzgy?=
 =?utf-8?B?ZXNRSWs1cjJ1ZnZsWkJqOUk3RkowOGVobEdRaVdFc1ExemJpeHlhZUNXMEw2?=
 =?utf-8?B?OHRyQjJIOFp4MC9Bem45WjRtTzVzYzRCZ083bm1PL2JMQ0orOTZEa0hId2NN?=
 =?utf-8?B?d1BvN3JvdlhOMjRyQThhQS9pYmIrdzFIaThHNWdDM3prWXlIUjEraStHVEov?=
 =?utf-8?B?L0JucDRPZW9hMGtpTk1lcTdsYWtNTEorWENBb0VYWXNiNXZyamNWd24vRm5s?=
 =?utf-8?B?cFN5K0ZIeTFMeUM1SllWTlY4WWhXK2o3aThPMjg1MDhHT1hUdk1aYlUxWEVS?=
 =?utf-8?B?bjhseW00MHAxa0lGZTEyZWZ6RmszQk5RYmw3MXFJdHJmZkhUSEtEL1JTU0dz?=
 =?utf-8?B?S0JNL0lwMUVDeFFXQmxVOXV3NTlOQXR4STQzUXRlaDljc0daQXJ0dGlzekha?=
 =?utf-8?B?WU1kUGI0ZEJLWU1JRjdwSHVnRUtsTWpRSG5JMGpiQkt6eGMvUERpWWx5d0l4?=
 =?utf-8?B?UGFNaTYwODV1S2hkbjVnc0xaOGxaSC9ENWdPdDhLdGZ4RktmNE5NelIxWEpE?=
 =?utf-8?B?M0h3aENvc0tYU29PR09BblpCZ0svZ2lQOUU3aTJCR1o4eFQreFdNUklhNW5S?=
 =?utf-8?B?M2RocmxDTDliMnBObXJULzRoMm9yemdEaFk4UVBESjVUbmt3cmJtUDg0Rkta?=
 =?utf-8?B?UTdnaE9YaGt3ajVSbmRuU2RZYTNmMjRNM25iWDkwanBFVzF6eFZ0RjhWbU1N?=
 =?utf-8?B?RnRrTVhRM2UvOENPTU55MWJ3WjBZei9CdnBqWHBtUmNjNHBzeFdNdXkwMkc1?=
 =?utf-8?B?Q0E0bElhQm5XRXU1UnIzVlltenhRZkNRRmE2eXduVnV1TWZQakROOVVocmpp?=
 =?utf-8?B?V1AxNksvekRBSEpDTUZLZnhHazlRPT0=?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 65af6175-bf7a-411a-6686-08d9be862586
X-MS-Exchange-CrossTenant-AuthSource: BN0PR10MB5192.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Dec 2021 22:16:01.7845
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: cEw7YT4aOJ6zorE3CoIN9SquFZ3zjhwsb/J1fhO17zc4xqdSPobOXT6PEsuVr5YVJCJil3mNl9tqBCwodRzcOnRp2yYKqffQYBRqaJOU95o=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN8PR10MB3730
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10197 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 phishscore=0 spamscore=0 suspectscore=0
 malwarescore=0 mlxlogscore=999 bulkscore=0 mlxscore=0 adultscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000
 definitions=main-2112130130
X-Proofpoint-ORIG-GUID: fkBMc5hq7dbp8ZAiNM7_bXTYMPUwUF9q
X-Proofpoint-GUID: fkBMc5hq7dbp8ZAiNM7_bXTYMPUwUF9q
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


On 12/13/2021 4:37 PM, Damien Le Moal wrote:
> On 2021/12/14 0:33, George Kennedy wrote:
>> Avoid data corruption by rejecting pass-through commands where
>> T_LENGTH is zero (No data is transferred) and the dma direction
>> is not DMA_NONE.
>>
>> Cc:<stable@vger.kernel.org>  # 5.4.y
> 5.4 only ? What about other LTS versions ? They do not have that bug ?
Our distros are based on 5.4.y, 5.15.y and 4.14.y, so the fix should go 
there,
but it looks like the fix is also needed in: 5.14.y, 5.13.y, 5.10.y, and 
4.19.y.

Thank you,
George
>
>> Reported-by: syzkaller<syzkaller@googlegroups.com>
>> Signed-off-by: George Kennedy<george.kennedy@oracle.com>
>> ---
>>    drivers/ata/libata-scsi.c | 6 ++++++
>>    1 file changed, 6 insertions(+)
>>
>> diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
>> index 1b84d55..d428392 100644
>> --- a/drivers/ata/libata-scsi.c
>> +++ b/drivers/ata/libata-scsi.c
>> @@ -2859,6 +2859,12 @@ static unsigned int ata_scsi_pass_thru(struct ata_queued_cmd *qc)
>>    		goto invalid_fld;
>>    	}
>>    
>> +	/* if T_LENGTH is zero (No data is transferred), then dir should be DMA_NONE */
>> +	if ((cdb[2 + cdb_offset] & 3) == 0 && scmd->sc_data_direction != DMA_NONE) {
>> +		fp = 2 + cdb_offset;
>> +		goto invalid_fld;
>> +	}
>> +
>>    	if (ata_is_ncq(tf->protocol) && (cdb[2 + cdb_offset] & 0x3) == 0)
>>    		tf->protocol = ATA_PROT_NCQ_NODATA;
>>    
>> -- 1.8.3.1
>>
>