From:   George Kennedy <george.kennedy@oracle.com>
To:     damien.lemoal@opensource.wdc.com
Cc:     george.kennedy@oracle.com, linux-ide@vger.kernel.org,
        linux-kernel@vger.kernel.org, stable@vger.kernel.org
Subject: [PATCH v2 RESEND] libata: if T_LENGTH is zero, dma direction should be DMA_NONE
Date:   Tue, 14 Dec 2021 09:45:10 -0500
Message-Id: <1639493110-15900-1-git-send-email-george.kennedy@oracle.com>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?nK14zH1Xdqb0lp5nvJ5ikDThjyVV/+wL7lYzaY6gXIRarv/deeiQNOqnOjQp?=
 =?us-ascii?Q?IUZaXokvHyI9UpYnPPCM8SHxaFweW2VPURqQ6jHkg4iLz+vE/ZAKQ8Uv0DdX?=
 =?us-ascii?Q?sG9thbhnmi4xd0izT5MTXRT8LyxI3j/JI/o+1Xe2H9ZvCsHiyDkQpQ03NojO?=
 =?us-ascii?Q?+5OUbIhbNLsMqEkxawMxkuH0Z4VtRzyhiK72asM7UbO6+WOHTablbWCVy0sG?=
 =?us-ascii?Q?QwJNH6nSNRMnN+ZoyO/srlq2Tt2HpX41CUWOTByoOOWLm1kn6WdQAU52WbWn?=
 =?us-ascii?Q?9VlcQe87fsLKiXCzE8towa4IZHEEYso9oBXHgnaYi00ESCRcrrEli3nZdXZJ?=
 =?us-ascii?Q?VOG6CudML6O9AcpzpiIaHd0Tu0Jq3qUfWaCOdmA/KK+b9i1/jekXYQVw+MH2?=
 =?us-ascii?Q?NJQdekNOU57AiCZlNu02FKniEiyk2B4CNa4lHTGABQlpft9kXa0L/Rq+bvoe?=
 =?us-ascii?Q?3Pdf8ZFsb5xkZHxnTE0p4X62ZOKBEHwzGdObzDQFaID/0/3yCcmDSI3XHwI/?=
 =?us-ascii?Q?7SAMr04iILn/eV788qJwTsfoPaQxwsyPlNfgb4klgiVIoKngEJO83VFI9jlG?=
 =?us-ascii?Q?mrRHNmonrMyr9uZbRmVYMPrbiXQxv6cI6NzXjhS6ktUstccH1IFgqR69qBBU?=
 =?us-ascii?Q?VvNYI1Ai1rnWeZ+8LlxJufftJxmF9i88hmgkGlAuV9CnZvY9SBIFNV7KmBxt?=
 =?us-ascii?Q?eRD1fn2se4NXEZvya83fRu6uRZSgkcegoY7gle2vSwcunP9gwLYdspNT9cqH?=
 =?us-ascii?Q?kwBq0cxySLexNE3bxpOGdT75kzUfvVjEdR3tNKRvtHI7P3pWfc+BGWYAO/9B?=
 =?us-ascii?Q?ebxmp42WRhC+e0RnbfdMjn77iy81m0Kpv1MkG4nLAiffWtZgjReuWD/tQkbv?=
 =?us-ascii?Q?pcmI40N7CTkGN2LAgsponinriUm8LuVU0rfecqRCGrVE7uU/AkcbUMI5dGyd?=
 =?us-ascii?Q?VqvTcs8VRI8ZATWyVEDReTy5B7TG5Ig8+8yWcKaHa+HcvxrfmmXvyvPxR6qS?=
 =?us-ascii?Q?8Ifmxa909dGPy1ClXIXkGpGbPTTp/2+GwRRU4Wkn5UTqW/Zc4TYo+7b7YkBE?=
 =?us-ascii?Q?q7JSL0sJY69847IkFvHALYVKECyslRpMt91GtRLiAMsaZ42LWZEAnEG0F1sy?=
 =?us-ascii?Q?tC2rMp01iLdGRPbmB1wj4B1XwJN+dhtgryeyCgq2pq3lYtkyrqSxeytoHV5D?=
 =?us-ascii?Q?7EJeBnLV3MI6uJ4IBv4fJ9sM4Q0M3Ig1i0QEcdNJuHOWmjzjB5paEnuQPpah?=
 =?us-ascii?Q?gaAb0sDrze08TCQ/YDiNeynHc1JDroWma8RIbiKoiP9S9uC8LaAigjI7V16t?=
 =?us-ascii?Q?rfKr8nsSsOY7/Of5glWqKbP2+B1hOYTP9iFCTrbfaek8Gk1gNtiLlxT5kpsg?=
 =?us-ascii?Q?LJtg6H96VhNP7vc0PUmxMK8XUl2jOUrLDANKVO1EBNucHFq6++a6VMVhnFZn?=
 =?us-ascii?Q?PR0NsCEptIJO6fQtG4qqc+rU6BQhNYSFtr8TSReqpBTYUk/ahFBDWfGZ5Drt?=
 =?us-ascii?Q?8xqZkPwOgo3yc5m2SXiM1j2HcHNvtWNbVgswPkUbmAj0rjSlgGhpjlfbU6F/?=
 =?us-ascii?Q?nIV9T+5q84QPlRWcnuSoHbagHMe7ZUgLh4GhpPxfClsYFp7T9fYAaBadOAiP?=
 =?us-ascii?Q?2JPFhyvEaqSrJXl1KnYVIBtEfgIbxOCYyQx77bVX2P2RZCvdGbOWmOwI+cY0?=
 =?us-ascii?Q?1wL06w=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: e171871f-f216-4775-9eb3-08d9bf10988c
X-MS-Exchange-CrossTenant-AuthSource: BN0PR10MB5192.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Dec 2021 14:47:05.0620
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: noWnEP57BO8rkNtnZV7MP2NwsTD/A3PXx7tERi/WUqbioI+ON/5xtxmZkhOnhsdKNk8MqQy2/XzRQKUu+iJnkx/CujOdL6+EwFoRk8U4qag=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR1001MB2387
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10197 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 adultscore=0
 malwarescore=0 bulkscore=0 spamscore=0 mlxlogscore=967 mlxscore=0
 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2110150000 definitions=main-2112140085
X-Proofpoint-ORIG-GUID: mgLnlRdVu-VbXJHc2qG-iGCxJAk0DEY1
X-Proofpoint-GUID: mgLnlRdVu-VbXJHc2qG-iGCxJAk0DEY1
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Avoid data corruption by rejecting pass-through commands where
T_LENGTH is zero (No data is transferred) and the dma direction
is not DMA_NONE.

Cc: <stable@vger.kernel.org>
Reported-by: syzkaller<syzkaller@googlegroups.com>
Signed-off-by: George Kennedy<george.kennedy@oracle.com>
---
Used the Maintainers suggested fix.

 drivers/ata/libata-scsi.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 1b84d55..313e947 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -2859,8 +2859,19 @@ static unsigned int ata_scsi_pass_thru(struct ata_queued_cmd *qc)
 		goto invalid_fld;
 	}
 
-	if (ata_is_ncq(tf->protocol) && (cdb[2 + cdb_offset] & 0x3) == 0)
-		tf->protocol = ATA_PROT_NCQ_NODATA;
+	if ((cdb[2 + cdb_offset] & 0x3) == 0) {
+		/*
+		 * When T_LENGTH is zero (No data is transferred), dir should
+		 * be DMA_NONE.
+		 */
+		if (scmd->sc_data_direction != DMA_NONE) {
+			fp = 2 + cdb_offset;
+			goto invalid_fld;
+		}
+
+		if (ata_is_ncq(tf->protocol))
+			tf->protocol = ATA_PROT_NCQ_NODATA;
+	}
 
 	/* enable LBA */
 	tf->flags |= ATA_TFLAG_LBA;
-- 
1.8.3.1