Re: [PATCH 1/2] ata: libata-core: Clamp the concurrent positioning ranges count

[Damien Le Moal]

On 6/20/26 11:36, Bryam Vargas via B4 Relay wrote:
> From: Bryam Vargas <hexlabsecurity@xxxxxxxxx>
> 
> ata_dev_config_cpr() sizes the log buffer from the length reported in
> the GPL directory but takes the number of range descriptors from buf[0],
> which the device reports independently. A device advertising a small log
> but a large count makes the descriptor loop read past the buffer: a
> one-sector log with buf[0] = 255 reaches up to 7704 bytes beyond the
> 512-byte allocation, a slab out-of-bounds read whose contents are then
> handed to the initiator through INQUIRY VPD page B9h.
> 
> Clamp the descriptor count to what the allocated buffer holds, as
> sd_read_cpr() already does on the SCSI side.
> 
> Fixes: c745dfc541e7 ("libata: fix reading concurrent positioning ranges log")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Bryam Vargas <hexlabsecurity@xxxxxxxxx>
> ---
>  drivers/ata/libata-core.c | 11 +++++++++++
>  1 file changed, 11 insertions(+)
> 
> diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
> index 3d0027ec33c2..e8d708f0810e 100644
> --- a/drivers/ata/libata-core.c
> +++ b/drivers/ata/libata-core.c
> @@ -2832,6 +2832,17 @@ static void ata_dev_config_cpr(struct ata_device *dev)
>  	if (!nr_cpr)
>  		goto out;
>  
> +	/*
> +	 * The log size is reported in the GPL directory independently of the
> +	 * number of range descriptors in buf[0]. Clamp the count to what the
> +	 * allocated buffer holds so the loop below cannot read past it.
> +	 */
> +	if (buf_len < 64 + (size_t)nr_cpr * 32) {
> +		nr_cpr = buf_len > 64 ? (buf_len - 64) / 32 : 0;
> +		if (!nr_cpr)
> +			goto out;
> +	}

If the device gives an invalid number of ranges, we should not try to fix the
broken value and warn and ignore it entirely. So let's simplify this:

	if (buf_len < 64 + (size_t)nr_cpr * 32) {
		ata_dev_warn(dev,
			"Invalid number of concurrent positioning ranges\n");
		goto out;
	}


-- 
Damien Le Moal
Western Digital Research