tree 6430450545ca1000e4dac80c2828cbbcd745abef
parent e15c2ffa1091c4f72370f01af4de8f9dddeb17a6
author Jens Axboe <axboe@kernel.dk> 1565202052 -0600
committer Jens Axboe <axboe@kernel.dk> 1565202052 -0600

libata: have ata_scsi_rw_xlat() fail invalid passthrough requests

For passthrough requests, libata-scsi takes what the user passes in
as gospel. This can be problematic if the user fills in the CDB
incorrectly. One example of that is in request sizes. For read/write
commands, the CDB contains fields describing the transfer length of
the request. These should match with the SG_IO header fields, but
libata-scsi currently does no validation of that.

Check that the number of blocks in the CDB for passthrough requests
matches what was mapped into the request. If the CDB asks for more
data then the validated SG_IO header fields, error it.

Reported-by: Krishna Ram Prakash R <krp@gtux.in>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>