[PATCH] ata: libata-scsi: fix ata_scsi_security_inout_xlat() buffer length conversion

[Damien Le Moal <dlemoal@kernel.org>]

ata_scsi_security_inout_xlat() converts the SCSI command buffer length
into the ATA sector size based size by aligning upward the length to 512B.
That is incorrect as that can lead to specifying a buffer size that is
larger than the memory allocated for the command buffer, resulting in all
sorts of possible command failures and/or memory corruptions.

Ideally, we should bounce the buffer to a large enough size to fit
the entire SCSI command buffer, but we do not have anything in place to do
that cleanly. So for now, fix this by converting the command buffer length
downward with a simple division of the buffer length by ATA_SECT_SIZE.

Fixes: 818831c8b22f ("libata: implement SECURITY PROTOCOL IN/OUT")
Cc: stable@vger.kernel.org
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
---
 drivers/ata/libata-scsi.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index d54ec1631e9a..e78801e7ea8c 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -4330,7 +4330,13 @@ static unsigned int ata_scsi_security_inout_xlat(struct ata_queued_cmd *qc)
 		}
 
 		/* convert to the sector-based ATA addressing */
-		len = (len + 511) / 512;
+		if (len) {
+			len = len / ATA_SECT_SIZE;
+			if (!len) {
+				ata_scsi_set_invalid_field(qc->dev, scmd, 6, 0);
+				return 1;
+			}
+		}
 	}
 
 	tf->protocol = dma ? ATA_PROT_DMA : ATA_PROT_PIO;
-- 
2.54.0