Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit db5db4b9 authored by Bart Van Assche's avatar Bart Van Assche Committed by Martin K. Petersen
Browse files

scsi: sd: Protect against READ(6) or WRITE(6) with zero block transfer length 



Since the READ(6) and WRITE(6) commands interpret a zero in the transfer
length field in the CDB as 256 logical blocks, avoid submitting such
commands.

Cc: Douglas Gilbert <dgilbert@interlog.com>
Cc: Hannes Reinecke <hare@suse.com>
Cc: Christoph Hellwig <hch@lst.de>
Reported-by: default avatarDouglas Gilbert <dgilbert@interlog.com>
Signed-off-by: default avatarBart Van Assche <bvanassche@acm.org>
Reviewed-by: default avatarDouglas Gilbert <dgilbert@interlog.com>
Reviewed-by: default avatarHannes Reinecke <hare@suse.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 59abc8cc

drivers/scsi/sd.c

+4 −0
Original line number Diff line number Diff line
@@ -1128,6 +1128,10 @@ static blk_status_t sd_setup_rw6_cmnd(struct scsi_cmnd *cmd, bool write, 
				      sector_t lba, unsigned int nr_blocks,

				      unsigned char flags)

{

	/* Avoid that 0 blocks gets translated into 256 blocks. */

	if (WARN_ON_ONCE(nr_blocks == 0))

		return BLK_STS_IOERR;



	if (unlikely(flags & 0x8)) {

		/*

		 * This happens only if this drive failed 10byte rw