Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6:
[SCSI] pmcraid: reject negative request size
[SCSI] put stricter guards on queue dead checks
[SCSI] scsi_dh: fix reference counting in scsi_dh_activate error path
[SCSI] mpt2sas: prevent heap overflows and unchecked reads
+38
-13
+6
-3
drivers/scsi/device_handler/scsi_dh.c
+6
-3
drivers/scsi/device_handler/scsi_dh.c
···
394
394
unsigned long flags;
395
395
struct scsi_device *sdev;
396
396
struct scsi_device_handler *scsi_dh = NULL;
397
+
struct device *dev = NULL;
397
398
398
399
spin_lock_irqsave(q->queue_lock, flags);
399
400
sdev = q->queuedata;
400
401
if (sdev && sdev->scsi_dh_data)
401
402
scsi_dh = sdev->scsi_dh_data->scsi_dh;
402
-
if (!scsi_dh || !get_device(&sdev->sdev_gendev) ||
403
+
dev = get_device(&sdev->sdev_gendev);
404
+
if (!scsi_dh || !dev ||
403
405
sdev->sdev_state == SDEV_CANCEL ||
404
406
sdev->sdev_state == SDEV_DEL)
405
407
err = SCSI_DH_NOSYS;
···
412
410
if (err) {
413
411
if (fn)
414
412
fn(data, err);
415
-
return err;
413
+
goto out;
416
414
}
417
415
418
416
if (scsi_dh->activate)
419
417
err = scsi_dh->activate(sdev, fn, data);
420
-
put_device(&sdev->sdev_gendev);
418
+
out:
419
+
put_device(dev);
421
420
return err;
422
421
}
423
422
EXPORT_SYMBOL_GPL(scsi_dh_activate);
+21
-2
drivers/scsi/mpt2sas/mpt2sas_ctl.c
+21
-2
drivers/scsi/mpt2sas/mpt2sas_ctl.c
···
688
688
goto out;
689
689
}
690
690
691
+
/* Check for overflow and wraparound */
692
+
if (karg.data_sge_offset * 4 > ioc->request_sz ||
693
+
karg.data_sge_offset > (UINT_MAX / 4)) {
694
+
ret = -EINVAL;
695
+
goto out;
696
+
}
697
+
691
698
/* copy in request message frame from user */
692
699
if (copy_from_user(mpi_request, mf, karg.data_sge_offset*4)) {
693
700
printk(KERN_ERR "failure at %s:%d/%s()!\n", __FILE__, __LINE__,
···
1970
1963
Mpi2DiagBufferPostReply_t *mpi_reply;
1971
1964
int rc, i;
1972
1965
u8 buffer_type;
1973
-
unsigned long timeleft;
1966
+
unsigned long timeleft, request_size, copy_size;
1974
1967
u16 smid;
1975
1968
u16 ioc_status;
1976
1969
u8 issue_reset = 0;
···
2006
1999
return -ENOMEM;
2007
2000
}
2008
2001
2002
+
request_size = ioc->diag_buffer_sz[buffer_type];
2003
+
2009
2004
if ((karg.starting_offset % 4) || (karg.bytes_to_read % 4)) {
2010
2005
printk(MPT2SAS_ERR_FMT "%s: either the starting_offset "
2011
2006
"or bytes_to_read are not 4 byte aligned\n", ioc->name,
···
2015
2006
return -EINVAL;
2016
2007
}
2017
2008
2009
+
if (karg.starting_offset > request_size)
2010
+
return -EINVAL;
2011
+
2018
2012
diag_data = (void *)(request_data + karg.starting_offset);
2019
2013
dctlprintk(ioc, printk(MPT2SAS_INFO_FMT "%s: diag_buffer(%p), "
2020
2014
"offset(%d), sz(%d)\n", ioc->name, __func__,
2021
2015
diag_data, karg.starting_offset, karg.bytes_to_read));
2022
2016
2017
+
/* Truncate data on requests that are too large */
2018
+
if ((diag_data + karg.bytes_to_read < diag_data) ||
2019
+
(diag_data + karg.bytes_to_read > request_data + request_size))
2020
+
copy_size = request_size - karg.starting_offset;
2021
+
else
2022
+
copy_size = karg.bytes_to_read;
2023
+
2023
2024
if (copy_to_user((void __user *)uarg->diagnostic_data,
2024
-
diag_data, karg.bytes_to_read)) {
2025
+
diag_data, copy_size)) {
2025
2026
printk(MPT2SAS_ERR_FMT "%s: Unable to write "
2026
2027
"mpt_diag_read_buffer_t data @ %p\n", ioc->name,
2027
2028
__func__, diag_data);
+3
drivers/scsi/pmcraid.c
+3
drivers/scsi/pmcraid.c
+8
-8
drivers/scsi/scsi_sysfs.c
+8
-8
drivers/scsi/scsi_sysfs.c
···
322
322
kfree(evt);
323
323
}
324
324
325
-
if (sdev->request_queue) {
326
-
sdev->request_queue->queuedata = NULL;
327
-
/* user context needed to free queue */
328
-
scsi_free_queue(sdev->request_queue);
329
-
/* temporary expedient, try to catch use of queue lock
330
-
* after free of sdev */
331
-
sdev->request_queue = NULL;
332
-
}
325
+
/* NULL queue means the device can't be used */
326
+
sdev->request_queue = NULL;
333
327
334
328
scsi_target_reap(scsi_target(sdev));
335
329
···
931
937
if (sdev->host->hostt->slave_destroy)
932
938
sdev->host->hostt->slave_destroy(sdev);
933
939
transport_destroy_device(dev);
940
+
941
+
/* cause the request function to reject all I/O requests */
942
+
sdev->request_queue->queuedata = NULL;
943
+
944
+
/* Freeing the queue signals to block that we're done */
945
+
scsi_free_queue(sdev->request_queue);
934
946
put_device(dev);
935
947
}
936
948