diff options
| author | Damien Le Moal <dlemoal@kernel.org> | 2024-09-23 18:06:46 +0900 |
|---|---|---|
| committer | Damien Le Moal <dlemoal@kernel.org> | 2024-09-24 16:56:21 +0900 |
| commit | 03a9cfc1314bf75cc7a83995f3a029a7ebf49c05 (patch) | |
| tree | 34c075f85bf2559d219a73af17e64e96f71c3e1b /drivers/ata | |
| parent | e5dd410acb34c7341a0a93b429dcf3dabf9e3323 (diff) | |
| download | lwn-03a9cfc1314bf75cc7a83995f3a029a7ebf49c05.tar.gz lwn-03a9cfc1314bf75cc7a83995f3a029a7ebf49c05.zip | |
ata: libata-scsi: Fix ata_msense_control_spgt2()
ata_msense_control_spgt2() can be called even for devices that do not
support CDL when the user requests the ALL_SUB_MPAGES mode sense page,
but for such device, this will cause a NULL pointer dereference as
dev->cdl is NULL. Similarly, we should not return any data if
ata_msense_control_spgt2() is called when the user requested the
CDL_T2A_SUB_MPAGE or CDL_T2B_SUB_MPAGE pages for a device that does not
support CDL.
Avoid this potential NULL pointer dereference by checking if the device
support CDL on entry to ata_msense_control_spgt2() and return 0 if it
does not support CDL.
Reported-by: syzbot+37757dc11ee77ef850bb@syzkaller.appspotmail.com
Tested-by: syzbot+37757dc11ee77ef850bb@syzkaller.appspotmail.com
Fixes: 602bcf212637 ("ata: libata: Improve CDL resource management")
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Diffstat (limited to 'drivers/ata')
| -rw-r--r-- | drivers/ata/libata-scsi.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c index 061fe63497bf..97c84b0ec472 100644 --- a/drivers/ata/libata-scsi.c +++ b/drivers/ata/libata-scsi.c @@ -2245,10 +2245,15 @@ static inline u16 ata_xlat_cdl_limit(u8 *buf) static unsigned int ata_msense_control_spgt2(struct ata_device *dev, u8 *buf, u8 spg) { - u8 *b, *cdl = dev->cdl->desc_log_buf, *desc; + u8 *b, *cdl, *desc; u32 policy; int i; + if (!(dev->flags & ATA_DFLAG_CDL) || !dev->cdl) + return 0; + + cdl = dev->cdl->desc_log_buf; + /* * Fill the subpage. The first four bytes of the T2A/T2B mode pages * are a header. The PAGE LENGTH field is the size of the page |