github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-26 20:46:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
942e4a0e46
linux/drivers/ata
History
Matthias Goergens 80320b278f ata: libata-scsi: bound the ATA passthru sense descriptor writes 
When an ATA PASS-THROUGH command to an ATAPI device fails, the sense
buffer holds the device's REQUEST SENSE reply, and
ata_scsi_set_passthru_sense_fields() trusts its additional length
byte, sb[7], when adding the ATA Status Return descriptor.  A faulty
or malicious device can use that to make the kernel read and write
past the 96-byte buffer in three ways:

- scsi_sense_desc_find() is passed sb[7] + 8 as the buffer length, so
  its clamp against sb[7] does nothing and the walk runs off the end.
- A type-9 descriptor found near the end is filled in unchecked.
- A new descriptor at sb[8 + len] needs len + 22 bytes, not len + 14,
  so len 75..82 writes up to 8 bytes past the end.

Reproduced with KASAN under qemu, with the emulated ATAPI REQUEST SENSE
reply patched:

  BUG: KASAN: slab-out-of-bounds in scsi_sense_desc_find+0x1a5/0x210
  BUG: KASAN: slab-out-of-bounds in ata_scsi_qc_complete+0x1a15/0x1a50

Both are gone with this patch, and a valid descriptor is still filled
in.

Fixes: 9798192622 ("ata: libata-scsi: Do not overwrite valid sense data when CK_COND=1")
Cc: stable@vger.kernel.org
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Matthias Goergens <matthias.goergens@gmail.com>
Link: https://lore.kernel.org/r/20260923175203.1576825-1-matthias.goergens@gmail.com
Signed-off-by: Niklas Cassel <cassel@kernel.org>
2026-09-23 21:05:55 +02:00
..
pata_parport ata: pata_parport: switch to dynamic root device 2026-04-27 11:38:16 +02:00
acard-ahci.c ata: Use named initializers for pci_device_id arrays 2026-06-12 11:44:30 +02:00
ahci_brcm.c ahci: Introduce ahci_ignore_port() helper 2025-01-09 17:52:17 +09:00
ahci_ceva.c ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() 2026-07-18 10:37:02 +09:00
ahci_da850.c ata: ahci_da850: use devm_platform_ioremap_resource() 2026-07-18 11:58:16 +09:00
ahci_dm816.c ata: libata-eh: Simplify reset operation management 2025-07-16 09:31:43 +02:00
ahci_dwc.c ata: ahci-dwc: Remove not-going-to-be-supported code for Baikal SoC 2026-02-24 15:29:57 +01:00
ahci_imx.c ata: libata: Document when host->eh_mutex should be held 2026-06-01 19:09:08 +02:00
ahci_mtk.c ata: Switch back to struct platform_driver::remove() 2024-10-17 09:55:08 +02:00
ahci_mvebu.c ata: Switch back to struct platform_driver::remove() 2024-10-17 09:55:08 +02:00
ahci_octeon.c ata: ahci_octeon: Convert to devm_platform_ioremap_resource() 2023-08-02 17:37:06 +09:00
ahci_platform.c ata: use named initializers for acpi_device_id 2026-08-04 18:48:43 +09:00
ahci_qoriq.c ata: use named initializers for acpi_device_id 2026-08-04 18:48:43 +09:00
ahci_seattle.c ata: use named initializers for acpi_device_id 2026-08-04 18:48:43 +09:00
ahci_st.c ahci: st: Switch from CONFIG_PM_SLEEP guards to pm_sleep_ptr() 2025-01-15 15:21:27 +01:00
ahci_sunxi.c Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
ahci_tegra.c ata: ahci_tegra: Explicitly specify PMC instance to use 2026-05-28 22:46:11 +02:00
ahci_xgene.c ata: use named initializers for acpi_device_id 2026-08-04 18:48:43 +09:00
ahci.c ata: ahci: work around lost interrupts on Marvell 88SE61xx 2026-09-02 07:00:09 +02:00
ahci.h ata: libata: Document when host->eh_mutex should be held 2026-06-01 19:09:08 +02:00
ata_generic.c ata: ata_generic: Don't store pci_device_id 2026-07-28 11:15:20 -05:00
ata_piix.c ata: Use named initializers for pci_device_id arrays 2026-06-12 11:44:30 +02:00
Kconfig ata: pata_ep93xx: add COMPILE_TEST support 2026-06-02 11:47:45 +02:00
libahci_platform.c ata: libahci_platform: Fix device reference leak in ahci_platform_get_resources() 2026-09-16 07:22:53 +02:00
libahci.c ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY 2026-09-15 11:13:31 +02:00
libata-acpi.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
libata-core.c ata: libata-core: Extend Samsung LPM quirk to AMD controllers 2026-09-21 13:08:58 +02:00
libata-eh.c ata changes for 7.3 2026-08-19 12:31:50 -07:00
libata-pata-timings.c ata: separate PATA timings code from libata-core.c 2020-03-26 10:28:19 -06:00
libata-pmp.c ata: libata-pmp: add JMicron JMS562 quirk 2026-06-10 11:39:37 +02:00
libata-sata.c ata: libata-sata: fix ata_scsi_lpm_supported() iteration 2026-07-29 10:55:11 +09:00
libata-scsi.c ata: libata-scsi: bound the ATA passthru sense descriptor writes 2026-09-23 21:05:55 +02:00
libata-sff.c ata: libata-sff: don't busy-wait for PIO data-in command completion 2026-07-21 08:55:31 +09:00
libata-trace.c ata: scsi: rename flag ATA_QCFLAG_FAILED to ATA_QCFLAG_EH 2023-01-04 13:36:26 +09:00
libata-transport.c ata: libata-transport: remove static variable ata_scsi_transport_template 2026-04-02 21:01:10 +02:00
libata-transport.h ata: libata-transport: remove static variable ata_scsi_transport_template 2026-04-02 21:01:10 +02:00
libata-zpodd.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
libata.h ata changes for 7.3 2026-08-19 12:31:50 -07:00
Makefile ata: libata: Document when host->eh_mutex should be held 2026-06-01 19:09:08 +02:00
pata_acpi.c ata: Use named initializers for pci_device_id arrays 2026-06-12 11:44:30 +02:00
pata_ali.c ata: libata-eh: Simplify reset operation management 2025-07-16 09:31:43 +02:00
pata_amd.c ata: Use named initializers for pci_device_id arrays 2026-06-12 11:44:30 +02:00
pata_arasan_cf.c ata: libata: Document when host->eh_mutex should be held 2026-06-01 19:09:08 +02:00
pata_artop.c ata: Use named initializers for pci_device_id arrays 2026-06-12 11:44:30 +02:00
pata_atiixp.c ata: libata-eh: Simplify reset operation management 2025-07-16 09:31:43 +02:00
pata_atp867x.c ata: Drop unused assignments of pci_device_id driver data 2026-06-12 11:43:53 +02:00
pata_buddha.c SCSI misc on 20260821 2026-08-21 11:23:20 -07:00
pata_cmd64x.c ata: Use named initializers for pci_device_id arrays 2026-06-12 11:44:30 +02:00
pata_cmd640.c ata: Drop unused assignments of pci_device_id driver data 2026-06-12 11:43:53 +02:00
pata_cs5520.c ata: pata_cs5520: Rephrase file header comment 2024-07-30 07:10:30 +09:00
pata_cs5530.c scsi: ata: Declare SCSI host templates const 2023-03-24 19:19:19 -04:00
pata_cs5535.c scsi: ata: Declare SCSI host templates const 2023-03-24 19:19:19 -04:00
pata_cs5536.c ata: pata_cs5536: fix build on 32-bit UML 2025-06-10 14:26:27 +02:00
pata_cypress.c ata: pata_cypress: fix typo in error message 2026-02-02 13:47:40 +09:00
pata_efar.c ata: libata-eh: Simplify reset operation management 2025-07-16 09:31:43 +02:00
pata_ep93xx.c ata: pata_ep93xx: fix PIO fallback when DMA init fails 2026-07-23 16:40:05 +09:00
pata_falcon.c ata: Switch back to struct platform_driver::remove() 2024-10-17 09:55:08 +02:00
pata_ftide010.c ata: pata_ftide010: Fix some DMA timings 2026-02-04 12:23:23 +01:00
pata_gayle.c ata: Switch back to struct platform_driver::remove() 2024-10-17 09:55:08 +02:00
pata_hpt3x2n.c ata: libata-eh: Simplify reset operation management 2025-07-16 09:31:43 +02:00
pata_hpt3x3.c scsi: ata: Declare SCSI host templates const 2023-03-24 19:19:19 -04:00
pata_hpt37x.c ata: libata-eh: Simplify reset operation management 2025-07-16 09:31:43 +02:00
pata_hpt366.c ata: libata-eh: Simplify reset operation management 2025-07-16 09:31:43 +02:00
pata_icside.c ata: libata-eh: Simplify reset operation management 2025-07-16 09:31:43 +02:00
pata_imx.c Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
pata_isapnp.c ata: pata_isapnp: Drop unused assignments from pnp_device_id array 2026-06-10 09:41:26 +02:00
pata_it821x.c ata: pata_it821x: Replace deprecated strcpy with strscpy in it821x_display_disk 2025-10-23 14:23:40 +02:00
pata_it8213.c ata: libata-eh: Simplify reset operation management 2025-07-16 09:31:43 +02:00
pata_ixp4xx_cf.c ata: Switch back to struct platform_driver::remove() 2024-10-17 09:55:08 +02:00
pata_jmicron.c ata: Drop unused assignments of pci_device_id driver data 2026-06-12 11:43:53 +02:00
pata_legacy.c ata: pata_legacy: remove VLB support 2026-02-02 13:47:37 +09:00
pata_macio.c ata: Drop unused assignments of pci_device_id driver data 2026-06-12 11:43:53 +02:00
pata_marvell.c ata: libata-eh: Simplify reset operation management 2025-07-16 09:31:43 +02:00
pata_mpc52xx.c ata: pata_mpc52xx: Remove redundant dev_err() 2026-07-18 10:09:19 +09:00
pata_mpiix.c ata: libata-eh: Simplify reset operation management 2025-07-16 09:31:43 +02:00
pata_netcell.c scsi: ata: Declare SCSI host templates const 2023-03-24 19:19:19 -04:00
pata_ninja32.c ata: Drop unused assignments of pci_device_id driver data 2026-06-12 11:43:53 +02:00
pata_ns87410.c ata: libata-eh: Simplify reset operation management 2025-07-16 09:31:43 +02:00
pata_ns87415.c ata: pata_ns87415: mark ns87560_tf_read static 2023-07-28 08:52:42 +09:00
pata_octeon_cf.c ata: libata-eh: Simplify reset operation management 2025-07-16 09:31:43 +02:00
pata_of_platform.c ata: Switch back to struct platform_driver::remove() 2024-10-17 09:55:08 +02:00
pata_oldpiix.c ata: libata-eh: Simplify reset operation management 2025-07-16 09:31:43 +02:00
pata_opti.c ata: Use named initializers for pci_device_id arrays 2026-06-12 11:44:30 +02:00
pata_optidma.c ata: libata-eh: Simplify reset operation management 2025-07-16 09:31:43 +02:00
pata_pcmcia.c ata: pata_pcmcia: Add Iomega Clik! PCMCIA ATA/ATAPI Adapter 2025-11-18 21:58:41 +01:00
pata_pdc202xx_old.c ata: Use named initializers for pci_device_id arrays 2026-06-12 11:44:30 +02:00
pata_pdc2027x.c ata: Use named initializers for pci_device_id arrays 2026-06-12 11:44:30 +02:00
pata_piccolo.c ata: Constify struct pci_device_id 2024-12-03 05:10:20 +01:00
pata_platform.c ata: Switch back to struct platform_driver::remove() 2024-10-17 09:55:08 +02:00
pata_pxa.c ata: pata_pxa: use devres for DMA channel management 2026-07-23 16:40:05 +09:00
pata_radisys.c ata: Fix typos in the comment 2024-10-01 09:22:02 +02:00
pata_rb532_cf.c ata: pata_rb532_cf: use devm_platform_ioremap_resource() 2026-07-18 11:58:16 +09:00
pata_rdc.c ata: libata-eh: Simplify reset operation management 2025-07-16 09:31:43 +02:00
pata_rz1000.c scsi: ata: Declare SCSI host templates const 2023-03-24 19:19:19 -04:00
pata_sc1200.c scsi: ata: Declare SCSI host templates const 2023-03-24 19:19:19 -04:00
pata_sch.c ata: Drop unused assignments of pci_device_id driver data 2026-06-12 11:43:53 +02:00
pata_serverworks.c ata: Use named initializers for pci_device_id arrays 2026-06-12 11:44:30 +02:00
pata_sil680.c scsi: ata: Declare SCSI host templates const 2023-03-24 19:19:19 -04:00
pata_sis.c ata: Use named initializers for pci_device_id arrays 2026-06-12 11:44:30 +02:00
pata_sl82c105.c ata: pata_sl82c105: fix bridge revision use-after-free 2026-08-07 00:55:53 +09:00
pata_triflex.c ata: libata-eh: Simplify reset operation management 2025-07-16 09:31:43 +02:00
pata_via.c ata: Use named initializers for pci_device_id arrays 2026-06-12 11:44:30 +02:00
pdc_adma.c ata: Use named initializers for pci_device_id arrays 2026-06-12 11:44:30 +02:00
sata_dwc_460ex.c ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning 2026-07-13 14:32:11 +09:00
sata_fsl.c ata: libata: Document when host->eh_mutex should be held 2026-06-01 19:09:08 +02:00
sata_gemini.c ata: sata_gemini: unwind clocks on IDE pinctrl errors 2026-07-03 13:44:18 +09:00
sata_gemini.h ata: sata_gemini: Remove unused gemini_sata_reset_bridge() 2024-12-11 13:18:25 +09:00
sata_highbank.c ata: sata_highbank: use devm_platform_ioremap_resource 2026-07-18 11:58:16 +09:00
sata_inic162x.c ata: libata: Document when host->eh_mutex should be held 2026-06-01 19:09:08 +02:00
sata_mv.c ata changes for 7.3 2026-08-19 12:31:50 -07:00
sata_nv.c ata: Use named initializers for pci_device_id arrays 2026-06-12 11:44:30 +02:00
sata_promise.c ata: Use named initializers for pci_device_id arrays 2026-06-12 11:44:30 +02:00
sata_promise.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 18 2019-05-21 11:28:46 +02:00
sata_qstor.c ata: Use named initializers for pci_device_id arrays 2026-06-12 11:44:30 +02:00
sata_rcar.c ata: libata-eh: Simplify reset operation management 2025-07-16 09:31:43 +02:00
sata_sil.c ata: Use named initializers for pci_device_id arrays 2026-06-12 11:44:30 +02:00
sata_sil24.c ata: Use named initializers for pci_device_id arrays 2026-06-12 11:44:30 +02:00
sata_sis.c ata: Use named initializers for pci_device_id arrays 2026-06-12 11:44:30 +02:00
sata_svw.c ata: Use named initializers for pci_device_id arrays 2026-06-12 11:44:30 +02:00
sata_sx4.c ata: Use named initializers for pci_device_id arrays 2026-06-12 11:44:30 +02:00
sata_uli.c ata: Use named initializers for pci_device_id arrays 2026-06-12 11:44:30 +02:00
sata_via.c ata: Use named initializers for pci_device_id arrays 2026-06-12 11:44:30 +02:00
sata_vsc.c ata: Drop unused assignments of pci_device_id driver data 2026-06-12 11:43:53 +02:00
sis.h