[lvc-project] [PATCH v5 5.10/5.15] ata: libata-scsi: check cdb length for VARIABLE_LENGTH_CMD commands

[Fedor Pchelkin]

On Fri, 16. Aug 21:32, Artem Sadovnikov wrote:

No upstream commit exists for this commit.

должно идти в самом начале письма отдельной строкой. Можно считать это
своеобразной заменой "[ Upstream commit ... ]", используемой в стандартных
бэкпорт-патчах.

> Fuzzing of 5.10 stable branch reports a slab-out-of-bounds error in
> ata_scsi_pass_thru.
> Backporting this commit would require significant changes to the code so
> it is better to use a simple fix for that particular error.

"this commit" - это  ce70fd9a551a ("scsi: core: Remove the cmd field from
struct scsi_request")

Логично поставить строку "Backporting this commit ..." после фразы про
"this error is fixed since 5.18 by commit ce70fd9a551a ..." . 

> No upstream commit exists for this commit.
> 
> The error is fixed in 5.18 by commit ce70fd9a551a ("scsi: core: Remove the
> cmd field from struct scsi_request") upstream.
> 
> The problem is that the length of the received SCSI command is not
> validated if scsi_op == VARIABLE_LENGTH_CMD. It can lead to out-of-bounds
> reading if the user sends a request with SCSI command of length less than
> 32.
> 
> Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
> 
> Signed-off-by: Artem Sadovnikov <ancowi69 at gmail.com>
> Signed-off-by: Mikhail Ivanov <iwanov-23 at bk.ru>
> Signed-off-by: Mikhail Ukhin <mish.uxin2012 at yandex.ru>
> Acked-by: Damien Le Moal <dlemoal at kernel.org>
> ---

Вот сюда после `---` можно добавить
Link: https://lore.kernel.org/lkml/20240711151546.341491-1-ancowi69@gmail.com/T/#u
unfortunately, stable at vger.kernel.org wasn't initially mentioned.

Прошу перепослать патч с подправлениями и дополнениями нам ещё раз,
пожалуйста.