From patchwork Wed Jan 23 19:12:37 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bart Van Assche X-Patchwork-Id: 10777763 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 972286C2 for ; Wed, 23 Jan 2019 19:13:32 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 84B272DAC8 for ; Wed, 23 Jan 2019 19:13:32 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 73C552DABF; Wed, 23 Jan 2019 19:13:32 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.7 required=2.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 080662DABF for ; Wed, 23 Jan 2019 19:13:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726157AbfAWTNb (ORCPT ); Wed, 23 Jan 2019 14:13:31 -0500 Received: from com-out001.mailprotect.be ([83.217.72.83]:41433 "EHLO com-out001.mailprotect.be" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725996AbfAWTNb (ORCPT ); Wed, 23 Jan 2019 14:13:31 -0500 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=mailprotect.be; s=mail; h=Content-Transfer-Encoding:MIME-Version:Message-Id :Date:Subject:Cc:To:From:reply-to:sender:bcc:in-reply-to:references: content-type; bh=bTqA2GofAWOWx+TqDzzq9IvW5CLmpWeF6yx83kzcWCk=; b=BNwFtdQSXRbr QhgazJJzB9BmY2cCmlgJf53NbQcP8bmbxZjVKI5vG+NeOVppuLJJX7RdSAAeTO/5cT49SPLoPfRi0 doACEWVn0KTakunUmoEPO0fad+cCYhG884e2NeXJPmMnoTt1uX/9hlmee0VQp/VjjIK2p/jhD+pKO FqqKey6wbcCNfBlr/tk70nTLfSqnvzgqpZ1oADppIOWCoPSz2v7yaBrNI31pS7yjRp73Ystr1Xed/ k3Eh032Fi0XJp+VXC+NtHGmsUiT6SEHP4SZu7ZRGejmO54Y5ie7Ru4G+rEV/zNRVm1np4NJCTS+y5 qfl3DAnhuKwX30ze3LXDfA==; Received: from smtp-auth.mailprotect.be ([178.208.39.155]) by com-mpt-out001.mailprotect.be with esmtp (Exim 4.89) (envelope-from ) id 1gmNxj-0001CN-Lt; Wed, 23 Jan 2019 20:13:24 +0100 Received: from desktop-bart.svl.corp.google.com (unknown [104.133.8.89]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp-auth.mailprotect.be (Postfix) with ESMTPSA id 30ADCC0396; Wed, 23 Jan 2019 20:13:19 +0100 (CET) From: Bart Van Assche To: "Martin K . Petersen" , "James E . J . Bottomley" Cc: linux-scsi@vger.kernel.org, Bart Van Assche , Douglas Gilbert , Hannes Reinecke , Christoph Hellwig Subject: [PATCH] sd: Protect against submitting READ(6) or WRITE(6) with 256 logical blocks Date: Wed, 23 Jan 2019 11:12:37 -0800 Message-Id: <20190123191237.119996-1-bvanassche@acm.org> X-Mailer: git-send-email 2.20.1.321.g9e740568ce-goog MIME-Version: 1.0 X-Originating-IP: 178.208.39.155 X-SpamExperts-Domain: mailprotect.be X-SpamExperts-Username: 178.208.39.128/27 Authentication-Results: mailprotect.be; auth=pass smtp.auth=178.208.39.128/27@mailprotect.be X-SpamExperts-Outgoing-Class: ham X-SpamExperts-Outgoing-Evidence: Combined (0.02) X-Recommended-Action: accept X-Filter-ID: EX5BVjFpneJeBchSMxfU5roCzTcS7r32bxtqJbbiB25602E9L7XzfQH6nu9C/Fh9KJzpNe6xgvOx q3u0UDjvO1tLifGj39bI0bcPyaJsYTZnx3upumnqWBHj0/Vmi/pASQQA8gPlICyOXF4VQA3r681n IyHanrMzYl1QUFnGrJlGZdzQSLJYSD89hpteF8v30ykPg8qyrdUV98WGlbOjhJdwZpOImhB57vlA Ovnv7bRi5a8LLfqBhzJbqPiIMA+NOnrCrjOMG+XIApsj4flbNpUCGeLmhx53FRJAP1Ea5ASWYHcP 06zXqyXOojRJS4zknlviJv/bhA0dm4U6iKb2qwTJsjWw5+0eZIpQIcK9yrRZBI4MtpSGpU9W4FdB tQesEelBF7Ngqas1fLSi+EsXiO7J//0XCxCMJn8bXo41UD3u+ZQGpXspg4TOqv23+spbzJ3vJBBY vcIXZcvdbj7fjbZn+1a2iCCdPFy3WGiBkBZc+BBb+UeYFBhPAZQ65C2d4vB6Mmh6nzlzGKK4CNTd FmC4kGAnKNZdqPIYy5/0C0oKEgxQF7G4ajroXShVPl5s3ZvBSOdcZaQYlKee2Vxut4iZ5ZA89caf AqxM+VvJzb/lgTl6fJxyntEfhZCKje4ZQ0jUIEfcq3/8iFZW9aviZrI0q854skGDr1SFWz9TrEbL my3uPSE9vyN9HoGBpQQMs9mOAuVGeNoxAGUS1QpH0KIcRmoNU2oljXXErZz3MdU5SJeoVHj5h7lL 06fEAVxIzKeWFsL83KrakodIBOvGMUyeAC+56yw1+v2L6yfd9eydk4bGlI/sStgnlIf76G2iUoks aCfSH23JFY6Md8TPjYHoRQJhikEW6KsZ+zue7BC3AMAEl0rnf3CZyCzXyHvANPJxkPHiWBBpWvV/ D/1d7+l+PmxJCFvdxzgiQpciHL7m0tbh53ymoHabC27dTg89RxqFwm50u99aXdYvNb//Pslq1T6/ YZi9tvOVU+N0ONIeujkNDaI1BZL4xlheqFLWgStYx12aCdmJgllbwzHk4lhd7+Z3ohEuqbhw2IGi K9BLVundUFjc1iJ5Hl/Q7TeMzDg6HYuTCyYgL61SIkBTYQaaIIEsvvc4Hs2Al+JCBW+Rho4Ph4F7 35SUHIxrP601Lz/dsiahQ1DFoGJGH4QvNEG2z3H+DG8i/+nwAPUMRDNTlQhcPtKTIltiNXw4wYHH 9itV4zOHtaDgH2x2DZDqYQ== X-Report-Abuse-To: spam@com-mpt-mgt001.mailprotect.be Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Since the READ(6) and WRITE(6) commands interpret a zero in the transfer length field in the CDB as 256 logical blocks, avoid submitting such commands. Cc: Douglas Gilbert Cc: Hannes Reinecke Cc: Christoph Hellwig Reported-by: Douglas Gilbert Signed-off-by: Bart Van Assche Reviewed-by: Douglas Gilbert Reviewed-by: Hannes Reinecke --- drivers/scsi/sd.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c index 4e69f182a1e5..b0eb83526c54 100644 --- a/drivers/scsi/sd.c +++ b/drivers/scsi/sd.c @@ -1129,6 +1129,10 @@ static blk_status_t sd_setup_rw6_cmnd(struct scsi_cmnd *cmd, bool write, sector_t lba, unsigned int nr_blocks, unsigned char flags) { + /* Avoid that 0 blocks gets translated into 256 blocks. */ + if (WARN_ON_ONCE(nr_blocks == 0)) + return BLK_STS_IOERR; + if (unlikely(flags & 0x8)) { /* * This happens only if this drive failed 10byte rw