From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794591286; b=tfR3d8B3ylmyqX3tuXR3jes+SBCDMrYpqP51EOTngQSw9QFFiqy3btIYtbhdZ3IreTYa tqQYtSC94N9BIKebNd6CRvpkTmDcNaUYmveeW5Fn8xyig3nHRf4vV99GN5cNo8IrFAKdq 7bJT2qE5kdKV6HBss9iHjrLE3FpgTFp7l/cpYNug7dUAs+TzYyC55jFVKu9rHM6MvJwso 4FpajWVdBOLJXvDbeNGGiDS2Nx9NKyZiydWbv+g4loOuNTgsk8iuGF8Qb/dl1EnOEjr/6 58SdcJH+7Ym2jdyeO5ObVWNcd99yiUyuyK4RFnSncn+AoNqY/Hv+ZNQyIgxjPgS7p2w== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794591286; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=sxVtPfdKzMWyPOGAQRiO96uDCvt7LWpJuDTdx2KBOQ8=; b=Y7G2nS+70fsKKFVmQ7VhdMxqtmOayfn3FT5EeUvfjVOGy7mqI5fyE3Y8ETKgM8ZRX+E3 iPKZDsSUjjUzPXP0DWZRKIQlgIbTOzQf6OuePOpNE7a1ov8vvsg+L6PyXiOcYY8elSvAv Ilz2L6mrKeNJXra7sUx5vqq1IR+Ra/Q/sLrDIO/tdN49V75/ZIZQrW1J1ds7cfddk9ZV+ AwjHwKNRLHw+udEL6bW7RO/gzokfGBcXMy2uUT6dV+hgaNs3nFlNqT4N6vE7QtNVLpf6Q 2gpvP1l4UemrOCVRkGLyJfcIyNfd0YIgqL5RT+fBG+Bz8PfUFKExfXte0inRMVeYKTg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=kOHO4Zap; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 687DA60A3824; Fri, 13 Nov 2026 17:34:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=kOHO4Zap Received: by smtp.kernel.org (Postfix) with ESMTPSA id 136851F000C4; Fri, 13 Nov 2026 17:34:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794591286; bh=sxVtPfdKzMWyPOGAQRiO96uDCvt7LWpJuDTdx2KBOQ8=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=kOHO4ZapuU0CdJ/ssOsEAB4/8S7IbPXpAew0cVt2PmiOsYXSrJepE8OymsKAzVOUp lpj0/jFkp1hmfMLzKh9U9fMFy2hqUWOujKtfXEaPRJzgijsV6rXEehYVzip8IjXzc5 6gD1n3xNj0D7T6rgzAeEA6pvj5e5HNkowD8DYgBY= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Zhao Gongyi , Damien Le Moal , Niklas Cassel , Sasha Levin Subject: [PATCH 6.12 405/670] ata: libata-scsi: reject data-in commands with a data-out buffer Date: Fri, 13 Nov 2026 10:49:29 -0500 Message-ID: <20261113153825.481233293@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261113153811.177190860@linuxfoundation.org> References: <20261113153811.177190860@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Zhao Gongyi [ Upstream commit a4845f077415ef32fe672c841e2fc58ae9e28273 ] SG_IO can submit a data-in SCSI command with DMA_TO_DEVICE. The scatterlist can then contain pages pinned without write access. ata_scsi_rbuf_fill() writes simulated replies to that scatterlist; in the reported case, the copy tried to write the shared zero page and faulted in the kernel. The same mismatch can affect SG_IO commands translated by libata. ZBC IN and GET PHYSICAL ELEMENT STATUS completion handlers can modify the receive buffer even if the drive aborts the command. For ATAPI, the successful INQUIRY completion also rewrites the buffer in atapi_fixup_inquiry(). Reject these mismatched commands before the buffer is written or the command is issued. Report ABORTED COMMAND / DATA IN BUFFER ERROR because the CDB itself can be valid; the supplied transfer direction is wrong. Backport notes: Use the older five-argument ata_scsi_set_sense() interface and spell DATA IN BUFFER ERROR as ASC/ASCQ 0x4b/0x0a. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Link: https://lore.kernel.org/r/20261104130638.37882-1-zhaogongyi@bytedance.com Cc: stable@vger.kernel.org Signed-off-by: Zhao Gongyi Reviewed-by: Damien Le Moal Signed-off-by: Niklas Cassel Signed-off-by: Sasha Levin --- drivers/ata/libata-scsi.c | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c index 6198192624141..0e309707f8828 100644 --- a/drivers/ata/libata-scsi.c +++ b/drivers/ata/libata-scsi.c @@ -1989,6 +1989,18 @@ static int ata_scsi_translate(struct ata_device *dev, struct scsi_cmnd *cmd, if (xlat_func(qc)) goto done; + /* + * A data-out request may contain pages pinned without write access. + * Reject a translated data-in command before issuing it, since its + * completion handler may write to the buffer even if the device fails. + */ + if (unlikely(cmd->sc_data_direction == DMA_TO_DEVICE && + ata_is_data(qc->tf.protocol) && + !(qc->tf.flags & ATA_TFLAG_WRITE))) { + ata_scsi_set_sense(dev, cmd, ABORTED_COMMAND, 0x4b, 0x0a); + goto done; + } + return ata_scsi_qc_issue(ap, qc); done: @@ -2020,6 +2032,12 @@ static void ata_scsi_rbuf_fill(struct ata_device *dev, struct scsi_cmnd *cmd, unsigned long flags; unsigned int len; + /* A data-out request may contain pages pinned without write access. */ + if (cmd->sc_data_direction == DMA_TO_DEVICE) { + ata_scsi_set_sense(dev, cmd, ABORTED_COMMAND, 0x4b, 0x0a); + return; + } + spin_lock_irqsave(&ata_scsi_rbuf_lock, flags); memset(ata_scsi_rbuf, 0, ATA_SCSI_RBUF_SIZE); @@ -3077,6 +3095,13 @@ static unsigned int atapi_xlat(struct ata_queued_cmd *qc) qc->complete_fn = atapi_qc_complete; + /* atapi_fixup_inquiry() writes to the buffer on successful completion. */ + if (scmd->sc_data_direction == DMA_TO_DEVICE && + scmd->cmnd[0] == INQUIRY) { + ata_scsi_set_sense(dev, scmd, ABORTED_COMMAND, 0x4b, 0x0a); + return 1; + } + qc->tf.flags |= ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE; if (scmd->sc_data_direction == DMA_TO_DEVICE) { qc->tf.flags |= ATA_TFLAG_WRITE; -- 2.53.0