From:   George Kennedy <george.kennedy@oracle.com>
To:     damien.lemoal@opensource.wdc.com
Cc:     george.kennedy@oracle.com, linux-ide@vger.kernel.org,
        linux-kernel@vger.kernel.org, stable@vger.kernel.org
Subject: [PATCH v2] libata: if T_LENGTH is zero, dma direction should be DMA_NONE
Date:   Tue, 14 Dec 2021 09:16:51 -0500
Message-Id: <1639491411-14401-1-git-send-email-george.kennedy@oracle.com>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?c5vnwzq0XBuUkKfAWDrj6k+YgusNxmmbKmr1UJxzQ6+RpvxxZ2pkKfCrqTyY?=
 =?us-ascii?Q?jxLad8sVv1HNSzPmTL6DIEA5CRbSaC0Mua8/dq5hikHIpyA2+jVZsL7uTYqd?=
 =?us-ascii?Q?Dapydzx8LuzTSjgdsx5LyYbezz1AYBphdkHblHRzVTI8G0O8g7ru8QoHYmls?=
 =?us-ascii?Q?Mx+zFsT6dqtQIXTBb3dXslmqDamr9vr7bfj8Y2Izht/juudpbJVBdDSNVhkj?=
 =?us-ascii?Q?ae+0pDGTtmaOQDtqWFU8i3wQPw9n6cGG14zmU7diF5CmbzRs7tgGsVS3O1q+?=
 =?us-ascii?Q?toUiYQn72cor+w0qKrqI9/Yn7hSDA0fsGEFjenqdYQT/hrHyTfW7F8xGB5Uj?=
 =?us-ascii?Q?51kU+FxrWWYYb6uQfk06Q8F27LZwfESkGDXGoghCgVEx05SLkA0uVKkYaGEB?=
 =?us-ascii?Q?gDx7uWGUgryWj5EPVpWA5e/0t3Erp2MzvTJdKeWEQ7TVqUpCB4gIgntCDm9O?=
 =?us-ascii?Q?pWcnKAo4puonke19LKM8rkJ+/7EfvMXWadfRtp+9UTz2HuU3kTIc7L/nisHd?=
 =?us-ascii?Q?eG0m6pmi1igbGXfCDk7VVdSdHTwMdsP67vd/djsGIjhy7m/LytmWERLcudei?=
 =?us-ascii?Q?vPIohP7XXwdMSHMW5V2RJXwAbw/3CFZRZxmAtOK3/aJ8sUFtgovuWSj+OSWB?=
 =?us-ascii?Q?L7pkQYfQA3kVyrgAInqASMfpMASN4evj+AakIWz7oevddexbiCnYHpnVEhHF?=
 =?us-ascii?Q?DaticPgiR8vzjeFhYtemv/xF8L3XIJEsCq7ZnwJz5nmuAtmTBv28u52ni38P?=
 =?us-ascii?Q?VVkWJwOJ5u+H/P87C2d3BQWEnG0jQF7axYeS9sL2YdqPuHzp6aLi4e1/X8aX?=
 =?us-ascii?Q?97c+d6oFuAadGfS9dktt6+iI9g0Eeb37HfSTwtjrVZsAVpT9HYwbcNah9b5W?=
 =?us-ascii?Q?kfEwHmJT/I7I1iuS/Lq8ymoXz2sz7i4E8jGUUos0UDNOous1f+TbGe1FdMzY?=
 =?us-ascii?Q?/nEGiJXUyyavFg+bHGyLM89O4EXGD4VQw1DmIqs9kKVfwD7PRpyQG6OHx83i?=
 =?us-ascii?Q?gW/pCqqs7DE90mWx8hHmmSprclAv4AEL2QwzCjMrIrCyHvjakmvwCqYNScca?=
 =?us-ascii?Q?8iVgYuOpq1qJm9tcSDHeGlXr2O9IcngUo6hxyd1Xyh5m+QaZ7RBinNY0tYqh?=
 =?us-ascii?Q?Pm5YX39NTe9g1yA09Xk4Fwdv4TsEXoSbxvrZ6zsEzAr/GL4iXP+BQscj8bI8?=
 =?us-ascii?Q?5xm36ZKx1Swto4WAptipumKjurwF8+oeEnPx9hxGD/0TclRdiMVkmHuJieyY?=
 =?us-ascii?Q?D7RkGe6dw8/TT9SZjxmQwvDUlRYZhCMeY5khnDlD/NM4PQoIW9lszHX9p1vm?=
 =?us-ascii?Q?vDJzdn8VZcRAjRMx7cin7TbyN4F+E53SE5Fpg7Nl224saKk5S6jPbbpelAdD?=
 =?us-ascii?Q?fh3MYv4JfE7dmb2G6+FbwXojJsdNBRMWFDgDUUm+fkqQQiLHnkljndHcmo2X?=
 =?us-ascii?Q?/1BJZXsz8e4Mfx+K/CjT7g8bVz/mjAmgJh1iuQswnvOyq3B/dysr86d7yiEs?=
 =?us-ascii?Q?dOfWcnGjJQZt9xlV1U2H0ITCsXeogZVUOXBNCX00Jr8Wazo7+150tn7iV55w?=
 =?us-ascii?Q?VCwAE4u79FG/sell+FP8m3f1Wp+MjglR0beISOHmf3/gYxOTJVBeWSbGRAle?=
 =?us-ascii?Q?H24RfgQGU99ZdSigpdh/T4/mSNzXDpk74R2O4yojL1FBfwUpCQei4MJz6VGb?=
 =?us-ascii?Q?KnE7mg=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: c86daa8c-c552-420e-a083-08d9bf0ca58c
X-MS-Exchange-CrossTenant-AuthSource: BN0PR10MB5192.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Dec 2021 14:18:48.9323
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: cDW+IqccZd2hJN5m5CM04D8UJXZiRA6ATOUNDt+ISA25D6Uk5BRn/KOmlRnhjOJH1YH3pBKOmAsCTQOf4/+hU8HKZ59YwwJil2JyBtF/IjQ=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR10MB1380
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10197 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 adultscore=0
 malwarescore=0 bulkscore=0 spamscore=0 mlxlogscore=884 mlxscore=0
 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2110150000 definitions=main-2112140083
X-Proofpoint-ORIG-GUID: -pm4z4pY34rgqrzXbACuzVSTpE2fTiEM
X-Proofpoint-GUID: -pm4z4pY34rgqrzXbACuzVSTpE2fTiEM
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Avoid data corruption by rejecting pass-through commands where
T_LENGTH is zero (No data is transferred) and the dma direction
is not DMA_NONE.

Cc: <stable@vger.kernel.org>
Reported-by: syzkaller<syzkaller@googlegroups.com>
Signed-off-by: George Kennedy<george.kennedy@oracle.com>
---
 drivers/ata/libata-scsi.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 1b84d55..313e947 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -2859,8 +2859,19 @@ static unsigned int ata_scsi_pass_thru(struct ata_queued_cmd *qc)
 		goto invalid_fld;
 	}
 
-	if (ata_is_ncq(tf->protocol) && (cdb[2 + cdb_offset] & 0x3) == 0)
-		tf->protocol = ATA_PROT_NCQ_NODATA;
+	if ((cdb[2 + cdb_offset] & 0x3) == 0) {
+		/*
+		 * When T_LENGTH is zero (No data is transferred), dir should
+		 * be DMA_NONE.
+		 */
+		if (scmd->sc_data_direction != DMA_NONE) {
+			fp = 2 + cdb_offset;
+			goto invalid_fld;
+		}
+
+		if (ata_is_ncq(tf->protocol))
+			tf->protocol = ATA_PROT_NCQ_NODATA;
+	}
 
 	/* enable LBA */
 	tf->flags |= ATA_TFLAG_LBA;
-- 
1.8.3.1