Re: [PATCH v2] ata: libata-scsi: bound the ATA passthru sense descriptor writes

[Niklas Cassel]

On Thu, 24 Sep 2026 01:52:03 +0800, Matthias Goergens wrote:
> When an ATA PASS-THROUGH command to an ATAPI device fails, the sense
> buffer holds the device's REQUEST SENSE reply, and
> ata_scsi_set_passthru_sense_fields() trusts its additional length
> byte, sb[7], when adding the ATA Status Return descriptor.  A faulty
> or malicious device can use that to make the kernel read and write
> past the 96-byte buffer in three ways:
> 
> [...]

Applied to libata/linux.git (for-7.3-fixes), thanks!

[1/1] ata: libata-scsi: bound the ATA passthru sense descriptor writes
      https://git.kernel.org/libata/linux/c/80320b27

Kind regards,
Niklas