[lvc-project] [PATCH v5 5.10/5.15] ata: libata-scsi: check cdb length for VARIABLE_LENGTH_CMD commands

[Fedor Pchelkin]

On Fri, 16. Aug 22:08, Fedor Pchelkin wrote:
> On Fri, 16. Aug 21:57, Artem Sadovnikov wrote:
> > No upstream commit exists for this commit.
> > 
> > Fuzzing of 5.10 stable branch reports a slab-out-of-bounds error in
> > ata_scsi_pass_thru.
> > 
> > The error is fixed in 5.18 by commit ce70fd9a551a ("scsi: core: Remove the
> > cmd field from struct scsi_request") upstream.
> > Backporting this commit would require significant changes to the code so
> > it is better to use a simple fix for that particular error.
> > 
> > The problem is that the length of the received SCSI command is not
> > validated if scsi_op == VARIABLE_LENGTH_CMD. It can lead to out-of-bounds
> > reading if the user sends a request with SCSI command of length less than
> > 32.
> > 
> > Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
> > 
> > Signed-off-by: Artem Sadovnikov <ancowi69 at gmail.com>
> > Signed-off-by: Mikhail Ivanov <iwanov-23 at bk.ru>
> > Signed-off-by: Mikhail Ukhin <mish.uxin2012 at yandex.ru>

Забыл важную деталь, о которой плохо отзываются мэйнтейнеры. Последний
Signed-off-by в списке должен быть отправителем письма, то есть вы.

На самом деле, если бэкпорт готовился несколькими людьми, то лучше это
оборачивать с Co-developed-by:
https://portal.linuxtesting.ru/How-to-send-patches-to-kernel.html#Co-developed-by

> > Acked-by: Damien Le Moal <dlemoal at kernel.org>
> > ---
> > Link: https://lore.kernel.org/lkml/20240711151546.341491-1-ancowi69@gmail.com/T/#u
> > unfortunately, stable at vger.kernel.org wasn't initially mentioned.
> 
> Как по мне, готово к отправке. Спасибо!
> 
> При отправке не забудьте про Грега и stable at vger.kernel.org - им To: .
> Damien Le Moal <dlemoal at kernel.org>, linux-kernel, lvc-project стоит
> добавить в Cc: .