mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity

scsi_transport_sas: fix BSG ioctl memory corruption 

The end_device and sas_host devices support BSG ioctls, but the
request_queue allocated for them isn't set up to allocate the struct
scsi_request payload. This leads to memory corruption in the call to
scsi_req_init() in bsg_map_hdr(), since it will memset past the end of
the allocated request. Fix it by setting ->cmd_size on the allocated
request_queue.

Fixes: 82ed4db499 ("block: split scsi_request out of struct request")
Signed-off-by: Omar Sandoval <osandov@fb.com>
Acked-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@fb.com>
This commit is contained in:
Omar Sandoval 2017-02-21 10:03:50 -08:00 committed by Jens Axboe
parent cccd9fb9ec
commit bd1599d931
1 changed files with 16 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
drivers/scsi/scsi_transport_sas.c
View File

@ -227,27 +227,31 @@ static int sas_bsg_initialize(struct Scsi_Host *shost, struct sas_rphy *rphy)
return 0; return 0;
} }
q = blk_alloc_queue(GFP_KERNEL);
if (!q)
return -ENOMEM;
q->cmd_size = sizeof(struct scsi_request);
if (rphy) { if (rphy) {
q = blk_init_queue(sas_non_host_smp_request, NULL); q->request_fn = sas_non_host_smp_request;
dev = &rphy->dev; dev = &rphy->dev;
name = dev_name(dev); name = dev_name(dev);
release = NULL; release = NULL;
} else { } else {
q = blk_init_queue(sas_host_smp_request, NULL); q->request_fn = sas_host_smp_request;
dev = &shost->shost_gendev; dev = &shost->shost_gendev;
snprintf(namebuf, sizeof(namebuf), snprintf(namebuf, sizeof(namebuf),
"sas_host%d", shost->host_no); "sas_host%d", shost->host_no);
name = namebuf; name = namebuf;
release = sas_host_release; release = sas_host_release;
} }
if (!q) error = blk_init_allocated_queue(q);
return -ENOMEM; if (error)
goto out_cleanup_queue;
error = bsg_register_queue(q, dev, name, release); error = bsg_register_queue(q, dev, name, release);
if (error) { if (error)
blk_cleanup_queue(q); goto out_cleanup_queue;
return -ENOMEM;
}
if (rphy) if (rphy)
rphy->q = q; rphy->q = q;
@ -261,6 +265,10 @@ static int sas_bsg_initialize(struct Scsi_Host *shost, struct sas_rphy *rphy)
queue_flag_set_unlocked(QUEUE_FLAG_BIDI, q); queue_flag_set_unlocked(QUEUE_FLAG_BIDI, q);
return 0; return 0;
out_cleanup_queue:
blk_cleanup_queue(q);
return error;
} }
static void sas_bsg_remove(struct Scsi_Host *shost, struct sas_rphy *rphy) static void sas_bsg_remove(struct Scsi_Host *shost, struct sas_rphy *rphy)