[PATCH] ata: libata-scsi: reject multi-sector taskfile commands when dev->multi_count is 0

[Hui Peng]

In ata_scsi_pass_thru() (drivers/ata/libata-scsi.c), issuing
ATA_CMD_READ_MULTI / ATA_CMD_WRITE_MULTI / ATA_CMD_READ_MULTI_EXT /
ATA_CMD_WRITE_MULTI_EXT / ATA_CMD_WRITE_MULTI_FUA_EXT via SG_IO when
dev->multi_count == 0 sets qc->sect_size = 0 and triggers a divide-by-
zero or WARN_ON in the ATA PIO/taskfile path. Reject ATA_PROT_PIO multi-
sector commands with -EINVAL when dev->multi_count == 0.

Fixes: c6fd280766a0 ("Move libata to drivers/ata.")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@xxxxxxxxx>
---
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index b3666519b648..c99f2845d09b 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -3507,6 +3507,11 @@ static unsigned int ata_scsi_pass_thru(struct ata_queued_cmd *qc)
 	if (is_multi_taskfile(tf)) {
 		unsigned int multi_count = 1 << (cdb[1] >> 5);
 
+		if (!dev->multi_count) {
+			fp = (cdb[0] == ATA_16) ? 14 : 9;
+			goto invalid_fld;
+		}
+
 		/* compare the passed through multi_count
 		 * with the cached multi_count of libata
 		 */