target/linux/apm821xx/patches-5.10/150-ata-sata_dwc_460ex-Fix-crash-due-to-OOB-write.patch

   1 From ba068938e629eb1a8b423a54405233e685cedb78 Mon Sep 17 00:00:00 2001
   2 Message-Id: <ba068938e629eb1a8b423a54405233e685cedb78.1647594132.git.chunkeey@gmail.com>
   3 From: Christian Lamparter <chunkeey@gmail.com>
   4 Date: Thu, 17 Mar 2022 21:29:28 +0100
   5 Subject: [PATCH v1 1/2] ata: sata_dwc_460ex: Fix crash due to OOB write
   6 To: linux-ide@vger.kernel.org
   7 Cc: Damien Le Moal <damien.lemoal@opensource.wdc.com>,
   8     Jens Axboe <axboe@kernel.dk>,
   9     Tejun Heo <tj@kernel.org>,
  10     Andy Shevchenko <andriy.shevchenko@linux.intel.com>
  11
  12 the driver uses libata's "tag" values from in various arrays.
  13 Since the mentioned patch bumped the ATA_TAG_INTERNAL to 32,
  14 the value of the SATA_DWC_QCMD_MAX needs to be bumped to 33.
  15
  16 Otherwise ATA_TAG_INTERNAL cause a crash like this:
  17
  18 | BUG: Kernel NULL pointer dereference at 0x00000000
  19 | Faulting instruction address: 0xc03ed4b8
  20 | Oops: Kernel access of bad area, sig: 11 [#1]
  21 | BE PAGE_SIZE=4K PowerPC 44x Platform
  22 | CPU: 0 PID: 362 Comm: scsi_eh_1 Not tainted 5.4.163 #0
  23 | NIP:  c03ed4b8 LR: c03d27e8 CTR: c03ed36c
  24 | REGS: cfa59950 TRAP: 0300   Not tainted  (5.4.163)
  25 | MSR:  00021000 <CE,ME>  CR: 42000222  XER: 00000000
  26 | DEAR: 00000000 ESR: 00000000
  27 | GPR00: c03d27e8 cfa59a08 cfa55fe0 00000000 0fa46bc0 [...]
  28 | [..]
  29 | NIP [c03ed4b8] sata_dwc_qc_issue+0x14c/0x254
  30 | LR [c03d27e8] ata_qc_issue+0x1c8/0x2dc
  31 | Call Trace:
  32 | [cfa59a08] [c003f4e0] __cancel_work_timer+0x124/0x194 (unreliable)
  33 | [cfa59a78] [c03d27e8] ata_qc_issue+0x1c8/0x2dc
  34 | [cfa59a98] [c03d2b3c] ata_exec_internal_sg+0x240/0x524
  35 | [cfa59b08] [c03d2e98] ata_exec_internal+0x78/0xe0
  36 | [cfa59b58] [c03d30fc] ata_read_log_page.part.38+0x1dc/0x204
  37 | [cfa59bc8] [c03d324c] ata_identify_page_supported+0x68/0x130
  38 | [...]
  39
  40 this is because sata_dwc_dma_xfer_complete() NULLs the
  41 dma_pending's next neighbour "chan" (a *dma_chan struct) in
  42 this '32' case right here (line ~735):
  43 > hsdevp->dma_pending[tag] = SATA_DWC_DMA_PENDING_NONE;
  44
  45 Then the next time, a dma gets issued; dma_dwc_xfer_setup() passes
  46 the NULL'd hsdevp->chan to the dmaengine_slave_config() which then
  47 causes the crash.
  48
  49 Reported-by: ticerex (OpenWrt Forum)
  50 Fixes: 28361c403683c ("libata: add extra internal command")
  51 Cc: stable@kernel.org # 4.18+
  52 Link: https://forum.openwrt.org/t/my-book-live-duo-reboot-loop/122464
  53 Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
  54 ---
  55 --- a/drivers/ata/sata_dwc_460ex.c
  56 +++ b/drivers/ata/sata_dwc_460ex.c
  57 @@ -145,7 +145,7 @@ struct sata_dwc_device {
  58  #endif
  59  };
  60
  61 -#define SATA_DWC_QCMD_MAX      32
  62 +#define SATA_DWC_QCMD_MAX      33
  63
  64  struct sata_dwc_device_port {
  65         struct sata_dwc_device  *hsdev;