On Mon, 27 Jan 2025 16:43:04 +0100, Niklas Cassel wrote:
reveliofuzzing reported that a SCSI_IOCTL_SEND_COMMAND ioctl with out_len set to 0xd42, SCSI command set to ATA_16 PASS-THROUGH, ATA command set to ATA_NOP, and protocol set to ATA_PROT_PIO, can cause ata_pio_sector() to write outside the allocated buffer, overwriting random memory.
While a ATA device is supposed to abort a ATA_NOP command, there does seem to be a bug either in libata-sff or QEMU, where either this status is not set, or the status is cleared before read by ata_sff_hsm_move(). Anyway, that is most likely a separate bug.
[...]
Applied to libata/linux.git (for-6.14), thanks!
[1/1] ata: libata-sff: Ensure that we cannot write outside the allocated buffer https://git.kernel.org/libata/linux/c/6e74e53b
Kind regards, Niklas