[lvc-project] [PATCH v4 5.10/5.15] ata: libata-scsi: check cdb length for VARIABLE_LENGTH_CMD commands

[Damien Le Moal]

On 6/28/24 5:08 AM, Sasha Levin wrote:
> On Thu, Jun 27, 2024 at 11:02:23AM +0900, Damien Le Moal wrote:
>> On 6/27/24 06:13, Mikhail Ukhin wrote:
>>> Fuzzing of 5.10 stable branch reports a slab-out-of-bounds error in
>>> ata_scsi_pass_thru.
>>>
>>> The error is fixed in 5.18 by commit ce70fd9a551a ("scsi: core: Remove the
>>> cmd field from struct scsi_request") upstream.
>>> Backporting this commit would require significant changes to the code so
>>> it is bettter to use a simple fix for that particular error.
>>
>> This sentence is not needed in the commit message. That is a discussion to have
>> when applying (or not) the patch.
> 
> It's good to have this reasoning in the commit message to, so that later
> when we look at the patch and try to understand why we needed something
> custom for the backport, the justification will be right there.

OK then, let's keep the commit message as it is.

Mikhail,

Please send a v5 patch with the correction I commented and the patch will be
good to go.

Thanks !

-- 
Damien Le Moal
Western Digital Research