libata: have ata_scsi_rw_xlat() fail invalid passthrough requests
authorJens Axboe <axboe@kernel.dk>
Wed, 7 Aug 2019 18:20:52 +0000 (12:20 -0600)
committerJens Axboe <axboe@kernel.dk>
Wed, 7 Aug 2019 18:20:52 +0000 (12:20 -0600)
commit2d7271501720038381d45fb3dcbe4831228fc8cc
tree6430450545ca1000e4dac80c2828cbbcd745abef
parente15c2ffa1091c4f72370f01af4de8f9dddeb17a6
libata: have ata_scsi_rw_xlat() fail invalid passthrough requests

For passthrough requests, libata-scsi takes what the user passes in
as gospel. This can be problematic if the user fills in the CDB
incorrectly. One example of that is in request sizes. For read/write
commands, the CDB contains fields describing the transfer length of
the request. These should match with the SG_IO header fields, but
libata-scsi currently does no validation of that.

Check that the number of blocks in the CDB for passthrough requests
matches what was mapped into the request. If the CDB asks for more
data then the validated SG_IO header fields, error it.

Reported-by: Krishna Ram Prakash R <krp@gtux.in>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
drivers/ata/libata-scsi.c