From mboxrd@z Thu Jan 1 00:00:00 1970 From: Eric Biggers Subject: Re: scsi: sg: assorted memory corruptions Date: Sun, 4 Feb 2018 01:07:10 -0800 Message-ID: <20180204090710.GA607@zzz.localdomain> References: <1516638634.2545.0.camel@wdc.com> <097921fa-52c5-8b2b-f564-4b24d9720478@interlog.com> <1517501859.3417.67.camel@codethink.co.uk> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Received: from mail-pl0-f66.google.com ([209.85.160.66]:34012 "EHLO mail-pl0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750855AbeBDJHN (ORCPT ); Sun, 4 Feb 2018 04:07:13 -0500 Content-Disposition: inline In-Reply-To: Sender: linux-ide-owner@vger.kernel.org List-Id: linux-ide@vger.kernel.org To: Dmitry Vyukov Cc: Ben Hutchings , Tejun Heo , linux-ide@vger.kernel.org, Doug Gilbert , Bart Van Assche , "jejb@linux.vnet.ibm.com" , "linux-scsi@vger.kernel.org" , "linux-kernel@vger.kernel.org" , "martin.petersen@oracle.com" , "syzkaller@googlegroups.com" On Thu, Feb 01, 2018 at 05:21:12PM +0100, 'Dmitry Vyukov' via syzkaller wrote: > On Thu, Feb 1, 2018 at 5:17 PM, Ben Hutchings > wrote: > > On Thu, 2018-02-01 at 08:04 +0100, Dmitry Vyukov wrote: > >> On Thu, Feb 1, 2018 at 7:03 AM, Douglas Gilbert wrote: > >> > On 2018-01-30 07:22 AM, Dmitry Vyukov wrote: > > [...] > >> > > [1:0:0:0] cd/dvd QEMU QEMU DVD-ROM 2.0. /dev/sr0 /dev/sg1 > >> > > > >> > > # readlink /sys/class/scsi_generic/sg0 > >> > > > >> > > ../../devices/pci0000:00/0000:00:01.1/ata1/host0/target0:0:0/0:0:0:0/scsi_generic/sg0 > >> > > > >> > > # cat /sys/class/scsi_generic/sg0/device/vendor > >> > > ATA > >> > > >> > > >> > ^^^^^ > >> > That subsystem is the culprit IMO, most likely libata. > >> > > >> > Until you can show this test failing on something other than an > >> > ATA disk, then I will treat this issue as closed. > >> > >> Hi Doug, > >> > >> Why is bug in ATA not a bug? Is it long unused by everybody? I've got > >> it by running qemu with default flags... > > > > If the bug is in libata then it's not on Doug to fix it since he's only > > maintaining sg. > > > Then I think we need to CC ata maintainers rather than treat it as closed. > +Tejun, linux-ide@, you can see full thread here: > https://groups.google.com/forum/#!topic/syzkaller/9RNr9Gu0MyY > To get memory corruption it's actually sufficient just to submit "1-byte" reads; there's no need for the SG_NEXT_CMD_LEN ioctl or anything: #include #include int main() { int fd = open("/dev/sg0", O_RDWR); char buf[43] = { [36] = 0x08 /* READ_6 */ }; for (;;) write(fd, buf, sizeof(buf)); } (where /dev/sg0 is the default QEMU disk type, "82371SB PIIX3 IDE") The SCSI command descriptor block is the 6 bytes at indices 36-41, so index 42 is the only data byte. Also this is a different bug from the crash in ata_bmdma_fill_sg() which is fixed by "libata: fix length validation of ATAPI-relayed SCSI commands". I'm guessing the driver is DMA'ing to somewhere it shouldn't be... Eric