PATCH libata-2.6 4/5] Prevent the device from overrunning the buffer in __atapi_pio_bytes()

[Albert Lee <albertcc@tw.ibm.com>]

[-- Attachment #1: Type: text/plain, Size: 945 bytes --]

Hi Jeff,

Problem:
   Some bad behaved CD-ROM drives will return more data than ask to.
(I have such CD-RW drive and it crashed the kernel.)

Changes:
- Add additional check in __atapi_pio_bytes() to prevent the device from overrunning the buffer.

Attached please find the patch against the libata-2.6 tree for your review. Thanks.

Albert

Signed-off-by: Albert Lee <albertcc@tw.ibm.com>
---------------------------------------
--- libata-2.6-reorder/drivers/scsi/libata-core.c	2005-03-18 12:56:44.000000000 +0800
+++ libata-2.6-extrabytes/drivers/scsi/libata-core.c	2005-03-18 14:00:34.000000000 +0800
@@ -2338,6 +2338,14 @@
  		ap->pio_task_state = PIO_ST_LAST;

  next_sg:
+	/* check whether qc->sg is full */
+	if (unlikely(qc->cursg >= qc->n_elem)) {
+		printk(KERN_WARNING "ata%u: qc->sg full, %u bytes trailing\n", ap->id, bytes);
+
+		ap->pio_task_state = PIO_ST_ERR;
+		return;
+	}
+
  	sg = &qc->sg[qc->cursg];

  	page = sg->page;


[-- Attachment #2: extrabytes.diff --]
[-- Type: text/plain, Size: 512 bytes --]

--- libata-2.6-reorder/drivers/scsi/libata-core.c	2005-03-18 12:56:44.000000000 +0800
+++ libata-2.6-extrabytes/drivers/scsi/libata-core.c	2005-03-18 14:00:34.000000000 +0800
@@ -2338,6 +2338,14 @@
 		ap->pio_task_state = PIO_ST_LAST;
 
 next_sg:
+	/* check whether qc->sg is full */
+	if (unlikely(qc->cursg >= qc->n_elem)) {
+		printk(KERN_WARNING "ata%u: qc->sg full, %u bytes trailing\n", ap->id, bytes);
+
+		ap->pio_task_state = PIO_ST_ERR;
+		return;
+	}
+
 	sg = &qc->sg[qc->cursg];
 
 	page = sg->page;