From patchwork Thu Jul 21 18:41:52 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tom Yan X-Patchwork-Id: 9242313 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id A2C7260756 for ; Thu, 21 Jul 2016 18:43:14 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 972311FF10 for ; Thu, 21 Jul 2016 18:43:14 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 8BA1927DE0; Thu, 21 Jul 2016 18:43:14 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 374611FF10 for ; Thu, 21 Jul 2016 18:43:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752416AbcGUSmm (ORCPT ); Thu, 21 Jul 2016 14:42:42 -0400 Received: from mail-pa0-f68.google.com ([209.85.220.68]:34215 "EHLO mail-pa0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752666AbcGUSmi (ORCPT ); Thu, 21 Jul 2016 14:42:38 -0400 Received: by mail-pa0-f68.google.com with SMTP id hh10so5651338pac.1; Thu, 21 Jul 2016 11:42:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=lD/jr25JjyzFgnVGuJ8QjvpXpBuzTL0ZsYUSkNGs7pc=; b=lJBqEMSA4qo7N23vcfCkGI6u0uUtq6xR1bPf8lbKgJZVroddI4m9rQQzirbqHv+LFI CGMbBKM4rYRr6swv5g+2WGkGWsXhk7Kdt1cVqerLVsUAXdP4LXstWETQJxW1BhRAdiSy 6H8jnsd3vZTwNe2HJopUSZK0YDQEAmN0ks1uPRLuaLSCkHUne5jZqmQBQz8mZjMEZqBw pCqmtBnRjVOcEviXsSLWJEvTw3JRJvHpJPGTd36AsY2TJMQ60DHGii1BgJ/rRoaqASom L7WOtYRmU841FRvE7K34DnCIKL2ZopOjViX9ZtRVXditdiMkf8Mq1bKdeuxh7i/k0XOL yKkQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=lD/jr25JjyzFgnVGuJ8QjvpXpBuzTL0ZsYUSkNGs7pc=; b=BL3DLrTsRg0Tgnj9Vf4VEgmSoRsUSGUuGYcKqtabkusdMNq1z+xfPupdklj3qmDExo CNxx9Nn519JbYdjL8DbL6a5MnLWw89eQ4VcVsn5VEibdlHPa1BoYXiAXMPZKrTfWoh+y 3FJjAi9A94NFHSO8fmJjn75cNRS7SSKISc0kd6XGLiR/GgsarRjy0MxUtHtb80ZA3+cY ELjjOe8H3ljZ/Wg+u3jR2142TLOsC17qg0G26WpmY9Z/I1zm9XLfyCZ0vrCGSzZVt/oW Xw598KytaD/qH7L+ckRl9rw0yQrKzestb2g35FHC7p+5kkWVzF6Qwid5xwomd1R+kp/U 6VWg== X-Gm-Message-State: ALyK8tLzYn5H7aProbYhsIvRjh0nhTwIp+GMKhGQKhbngmHj+z4hTbpT0/6BHOwkUskSew== X-Received: by 10.66.220.73 with SMTP id pu9mr84631640pac.77.1469126557139; Thu, 21 Jul 2016 11:42:37 -0700 (PDT) Received: from localhost.localdomain ([2404:c805:e00:4700:ae22:bff:fe29:e60c]) by smtp.gmail.com with ESMTPSA id j7sm14002691paa.30.2016.07.21.11.42.34 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 21 Jul 2016 11:42:36 -0700 (PDT) From: tom.ty89@gmail.com X-Google-Original-From: me To: tj@kernel.org, hare@suse.de, sergei.shtylyov@cogentembedded.com, arnd@arndb.de Cc: sfr@canb.auug.org.au, linux-ide@vger.kernel.org, linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org, linux-next@vger.kernel.org, Tom Yan Subject: [PATCH resend 3/5] libata-scsi: fix overflow in mode page copy Date: Fri, 22 Jul 2016 02:41:52 +0800 Message-Id: X-Mailer: git-send-email 2.9.0 In-Reply-To: References: Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Tom Yan ata_mselect_*() would initialize a char array for storing a copy of the current mode page. However, if char was actually signed char, overflow could occur. For example, `0xff` from def_control_mpage[] would be "truncated" to `-1`. This prevented ata_mselect_control() from working at all, since when it did the read-only bits check, there would always be a mismatch. Signed-off-by: Tom Yan diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c index ac90676..3c93341 100644 --- a/drivers/ata/libata-scsi.c +++ b/drivers/ata/libata-scsi.c @@ -3610,7 +3610,7 @@ static int ata_mselect_caching(struct ata_queued_cmd *qc, { struct ata_taskfile *tf = &qc->tf; struct ata_device *dev = qc->dev; - char mpage[CACHE_MPAGE_LEN]; + u8 mpage[CACHE_MPAGE_LEN]; u8 wce; int i; @@ -3675,7 +3675,7 @@ static int ata_mselect_control(struct ata_queued_cmd *qc, const u8 *buf, int len, u16 *fp) { struct ata_device *dev = qc->dev; - char mpage[CONTROL_MPAGE_LEN]; + u8 mpage[CONTROL_MPAGE_LEN]; u8 d_sense; int i;