On Mon, 27 Jan 2025 16:43:04 +0100, Niklas Cassel wrote:
> reveliofuzzing reported that a SCSI_IOCTL_SEND_COMMAND ioctl with out_len
> set to 0xd42, SCSI command set to ATA_16 PASS-THROUGH, ATA command set to
> ATA_NOP, and protocol set to ATA_PROT_PIO, can cause ata_pio_sector() to
> write outside the allocated buffer, overwriting random memory.
>
> While a ATA device is supposed to abort a ATA_NOP command, there does seem
> to be a bug either in libata-sff or QEMU, where either this status is not
> set, or the status is cleared before read by ata_sff_hsm_move().
> Anyway, that is most likely a separate bug.
>
> [...]
Applied to libata/linux.git (for-6.14), thanks!
[1/1] ata: libata-sff: Ensure that we cannot write outside the allocated buffer
https://git.kernel.org/libata/linux/c/6e74e53b
Kind regards,
Niklas
