Home Home > GIT Browse
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2018-07-10 16:03:29 +0200
committerTakashi Iwai <tiwai@suse.de>2018-07-10 16:03:52 +0200
commite7d346add23bf2ace10b0fbd485a2ee10c31075a (patch)
treecba51651ad7b3044cc6a51894989b7a8a9ce8a08
parent42b5ab6d95d74a985a08eaae4ebac7712a52b3cd (diff)
libata: zpodd: small read overflow in eject_tray()
(bsc#1051510).
-rw-r--r--patches.drivers/libata-zpodd-small-read-overflow-in-eject_tray37
-rw-r--r--series.conf1
2 files changed, 38 insertions, 0 deletions
diff --git a/patches.drivers/libata-zpodd-small-read-overflow-in-eject_tray b/patches.drivers/libata-zpodd-small-read-overflow-in-eject_tray
new file mode 100644
index 0000000000..531d2284e4
--- /dev/null
+++ b/patches.drivers/libata-zpodd-small-read-overflow-in-eject_tray
@@ -0,0 +1,37 @@
+From 18c9a99bce2a57dfd7e881658703b5d7469cc7b9 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 29 May 2018 12:13:24 +0300
+Subject: [PATCH] libata: zpodd: small read overflow in eject_tray()
+Git-commit: 18c9a99bce2a57dfd7e881658703b5d7469cc7b9
+Patch-mainline: v4.18-rc1
+References: bsc#1051510
+
+We read from the cdb[] buffer in ata_exec_internal_sg(). It has to be
+ATAPI_CDB_LEN (16) bytes long, but this buffer is only 12 bytes.
+
+Fixes: 213342053db5 ("libata: handle power transition of ODD")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Cc: stable@vger.kernel.org
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/ata/libata-zpodd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/ata/libata-zpodd.c b/drivers/ata/libata-zpodd.c
+index de4ddd0e8550..b3ed8f9953a8 100644
+--- a/drivers/ata/libata-zpodd.c
++++ b/drivers/ata/libata-zpodd.c
+@@ -35,7 +35,7 @@ struct zpodd {
+ static int eject_tray(struct ata_device *dev)
+ {
+ struct ata_taskfile tf;
+- static const char cdb[] = { GPCMD_START_STOP_UNIT,
++ static const char cdb[ATAPI_CDB_LEN] = { GPCMD_START_STOP_UNIT,
+ 0, 0, 0,
+ 0x02, /* LoEj */
+ 0, 0, 0, 0, 0, 0, 0,
+--
+2.18.0
+
diff --git a/series.conf b/series.conf
index 176ccc9d06..db7c751484 100644
--- a/series.conf
+++ b/series.conf
@@ -13593,6 +13593,7 @@
patches.drivers/serial-samsung-fix-maxburst-parameter-for-DMA-transa
patches.drivers/tty-serial-atmel-use-port-name-as-name-in-request_ir
patches.drivers/serial-8250-omap-Fix-idling-of-clocks-for-unused-uar
+ patches.drivers/libata-zpodd-small-read-overflow-in-eject_tray
patches.drivers/drm-i915-Restore-planes-after-load-detection
patches.drivers/drm-i915-psr-Chase-psr.enabled-only-under-the-psr.lo
patches.drivers/drm-exynos-Allow-DRM_EXYNOS-on-s5pv210