libata: zpodd: small read overflow in eject_tray()
authorDan Carpenter <dan.carpenter@oracle.com>
Tue, 29 May 2018 09:13:24 +0000 (12:13 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 26 Jun 2018 00:08:08 +0000 (08:08 +0800)
commit0e9806ec7376e1a285d7b9ee634a782f10155540
treec5325e5533b73b1f6a562f365155272b907c2c38
parent21e6919834360389b6f3db6a04603b6aba0c6219
libata: zpodd: small read overflow in eject_tray()

commit 18c9a99bce2a57dfd7e881658703b5d7469cc7b9 upstream.

We read from the cdb[] buffer in ata_exec_internal_sg().  It has to be
ATAPI_CDB_LEN (16) bytes long, but this buffer is only 12 bytes.

Fixes: 213342053db5 ("libata: handle power transition of ODD")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/ata/libata-zpodd.c