evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

scsi: sg: only check for dxfer_len greater than 256M

Browse source 
commit f930c7043663188429cd9b254e9d761edfc101ce upstream.

Don't make any assumptions on the sg_io_hdr_t::dxfer_direction or the
sg_io_hdr_t::dxferp in order to determine if it is a valid request. The
only way we can check for bad requests is by checking if the length
exceeds 256M.

Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
Fixes: 28676d869bbb (scsi: sg: check for valid direction before starting the request)
Reported-by: Jason L Tibbitts III <tibbs@math.uh.edu>
Tested-by: Jason L Tibbitts III <tibbs@math.uh.edu>
Suggested-by: Doug Gilbert <dgilbert@interlog.com>
Cc: Doug Gilbert <dgilbert@interlog.com>
Cc: <stable@vger.kernel.org>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Johannes Thumshirn 2017-07-27 09:11:26 +02:00 • committed by Greg Kroah-Hartman
parent db259b6768
commit 036c4bdd66
1 changed files with 1 additions and 30 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

31
drivers/scsi/sg.c
View file

@ -762,35 +762,6 @@ sg_new_write(Sg_fd *sfp, struct file *file, const char __user *buf,
return count; return count;
} }
static bool sg_is_valid_dxfer(sg_io_hdr_t *hp)
{
switch (hp->dxfer_direction) {
case SG_DXFER_NONE:
if (hp->dxferp || hp->dxfer_len > 0)
return false;
return true;
case SG_DXFER_FROM_DEV:
/*
* for SG_DXFER_FROM_DEV we always set dxfer_len to > 0. dxferp
* can either be NULL or != NULL so there's no point in checking
* it either. So just return true.
*/
return true;
case SG_DXFER_TO_DEV:
case SG_DXFER_TO_FROM_DEV:
if (!hp->dxferp || hp->dxfer_len == 0)
return false;
return true;
case SG_DXFER_UNKNOWN:
if ((!hp->dxferp && hp->dxfer_len) ||
(hp->dxferp && hp->dxfer_len == 0))
return false;
return true;
default:
return false;
}
}
static int static int
sg_common_write(Sg_fd * sfp, Sg_request * srp, sg_common_write(Sg_fd * sfp, Sg_request * srp,
unsigned char *cmnd, int timeout, int blocking) unsigned char *cmnd, int timeout, int blocking)
@ -811,7 +782,7 @@ sg_common_write(Sg_fd * sfp, Sg_request * srp,
"sg_common_write: scsi opcode=0x%02x, cmd_size=%d\n", "sg_common_write: scsi opcode=0x%02x, cmd_size=%d\n",
(int) cmnd[0], (int) hp->cmd_len)); (int) cmnd[0], (int) hp->cmd_len));
if (!sg_is_valid_dxfer(hp)) if (hp->dxfer_len >= SZ_256M)
return -EINVAL; return -EINVAL;
k = sg_start_req(srp, cmnd); k = sg_start_req(srp, cmnd);