From db5db4b91cabcf57f3efd98d92d24ab875cde8ae Mon Sep 17 00:00:00 2001 From: Bart Van Assche Date: Wed, 23 Jan 2019 11:12:37 -0800 Subject: scsi: sd: Protect against READ(6) or WRITE(6) with zero block transfer length Since the READ(6) and WRITE(6) commands interpret a zero in the transfer length field in the CDB as 256 logical blocks, avoid submitting such commands. Cc: Douglas Gilbert Cc: Hannes Reinecke Cc: Christoph Hellwig Reported-by: Douglas Gilbert Signed-off-by: Bart Van Assche Reviewed-by: Douglas Gilbert Reviewed-by: Hannes Reinecke Signed-off-by: Martin K. Petersen --- drivers/scsi/sd.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'drivers/scsi/sd.c') diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c index 7a1cf6c80f6a..4fbb8310e268 100644 --- a/drivers/scsi/sd.c +++ b/drivers/scsi/sd.c @@ -1128,6 +1128,10 @@ static blk_status_t sd_setup_rw6_cmnd(struct scsi_cmnd *cmd, bool write, sector_t lba, unsigned int nr_blocks, unsigned char flags) { + /* Avoid that 0 blocks gets translated into 256 blocks. */ + if (WARN_ON_ONCE(nr_blocks == 0)) + return BLK_STS_IOERR; + if (unlikely(flags & 0x8)) { /* * This happens only if this drive failed 10byte rw -- cgit