libata: zpodd: small read overflow in eject_tray()

Dan Carpenter · htejun · commit 18c9a99bce2a · 2018-05-29T06:48:54.000-07:00
We read from the cdb[] buffer in ata_exec_internal_sg(). It has to be ATAPI_CDB_LEN (16) bytes long, but this buffer is only 12 bytes. Fixes: 2133420 ("libata: handle power transition of ODD") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Tejun Heo <tj@kernel.org> Cc: stable@vger.kernel.org
diff --git a/drivers/ata/libata-zpodd.c b/drivers/ata/libata-zpodd.c
@@ -35,7 +35,7 @@ struct zpodd {
 static int eject_tray(struct ata_device *dev)
 {
 	struct ata_taskfile tf;
-	static const char cdb[] = {  GPCMD_START_STOP_UNIT,
+	static const char cdb[ATAPI_CDB_LEN] = {  GPCMD_START_STOP_UNIT,
 		0, 0, 0,
 		0x02,     /* LoEj */
 		0, 0, 0, 0, 0, 0, 0,

Original file line number	Diff line number	Diff line change
`@@ -35,7 +35,7 @@ struct zpodd {`
`35`	`35`	`static int eject_tray(struct ata_device *dev)`
`36`	`36`	`{`
`37`	`37`	`struct ata_taskfile tf;`
`38`		`- static const char cdb[] = { GPCMD_START_STOP_UNIT,`
	`38`	`+ static const char cdb[ATAPI_CDB_LEN] = { GPCMD_START_STOP_UNIT,`
`39`	`39`	`0, 0, 0,`
`40`	`40`	`0x02, /* LoEj */`
`41`	`41`	`0, 0, 0, 0, 0, 0, 0,`