[lvc-project] [PATCH v5 5.10/5.15] ata: libata-scsi: check cdb length for VARIABLE_LENGTH_CMD commands

[Fedor Pchelkin]

On Fri, 16. Aug 21:57, Artem Sadovnikov wrote:
> No upstream commit exists for this commit.
> 
> Fuzzing of 5.10 stable branch reports a slab-out-of-bounds error in
> ata_scsi_pass_thru.
> 
> The error is fixed in 5.18 by commit ce70fd9a551a ("scsi: core: Remove the
> cmd field from struct scsi_request") upstream.
> Backporting this commit would require significant changes to the code so
> it is better to use a simple fix for that particular error.
> 
> The problem is that the length of the received SCSI command is not
> validated if scsi_op == VARIABLE_LENGTH_CMD. It can lead to out-of-bounds
> reading if the user sends a request with SCSI command of length less than
> 32.
> 
> Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
> 
> Signed-off-by: Artem Sadovnikov <ancowi69 at gmail.com>
> Signed-off-by: Mikhail Ivanov <iwanov-23 at bk.ru>
> Signed-off-by: Mikhail Ukhin <mish.uxin2012 at yandex.ru>
> Acked-by: Damien Le Moal <dlemoal at kernel.org>
> ---
> Link: https://lore.kernel.org/lkml/20240711151546.341491-1-ancowi69@gmail.com/T/#u
> unfortunately, stable at vger.kernel.org wasn't initially mentioned.

Как по мне, готово к отправке. Спасибо!

При отправке не забудьте про Грега и stable at vger.kernel.org - им To: .
Damien Le Moal <dlemoal at kernel.org>, linux-kernel, lvc-project стоит
добавить в Cc: .