mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-23 01:10:04 +00:00
scsi_transport_sas: fix BSG ioctl memory corruption
The end_device and sas_host devices support BSG ioctls, but the
request_queue allocated for them isn't set up to allocate the struct
scsi_request payload. This leads to memory corruption in the call to
scsi_req_init() in bsg_map_hdr(), since it will memset past the end of
the allocated request. Fix it by setting ->cmd_size on the allocated
request_queue.
Fixes: 82ed4db499
("block: split scsi_request out of struct request")
Signed-off-by: Omar Sandoval <osandov@fb.com>
Acked-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@fb.com>
This commit is contained in:
parent
cccd9fb9ec
commit
bd1599d931
1 changed files with 16 additions and 8 deletions
|
@ -227,27 +227,31 @@ static int sas_bsg_initialize(struct Scsi_Host *shost, struct sas_rphy *rphy)
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
q = blk_alloc_queue(GFP_KERNEL);
|
||||||
|
if (!q)
|
||||||
|
return -ENOMEM;
|
||||||
|
q->cmd_size = sizeof(struct scsi_request);
|
||||||
|
|
||||||
if (rphy) {
|
if (rphy) {
|
||||||
q = blk_init_queue(sas_non_host_smp_request, NULL);
|
q->request_fn = sas_non_host_smp_request;
|
||||||
dev = &rphy->dev;
|
dev = &rphy->dev;
|
||||||
name = dev_name(dev);
|
name = dev_name(dev);
|
||||||
release = NULL;
|
release = NULL;
|
||||||
} else {
|
} else {
|
||||||
q = blk_init_queue(sas_host_smp_request, NULL);
|
q->request_fn = sas_host_smp_request;
|
||||||
dev = &shost->shost_gendev;
|
dev = &shost->shost_gendev;
|
||||||
snprintf(namebuf, sizeof(namebuf),
|
snprintf(namebuf, sizeof(namebuf),
|
||||||
"sas_host%d", shost->host_no);
|
"sas_host%d", shost->host_no);
|
||||||
name = namebuf;
|
name = namebuf;
|
||||||
release = sas_host_release;
|
release = sas_host_release;
|
||||||
}
|
}
|
||||||
if (!q)
|
error = blk_init_allocated_queue(q);
|
||||||
return -ENOMEM;
|
if (error)
|
||||||
|
goto out_cleanup_queue;
|
||||||
|
|
||||||
error = bsg_register_queue(q, dev, name, release);
|
error = bsg_register_queue(q, dev, name, release);
|
||||||
if (error) {
|
if (error)
|
||||||
blk_cleanup_queue(q);
|
goto out_cleanup_queue;
|
||||||
return -ENOMEM;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (rphy)
|
if (rphy)
|
||||||
rphy->q = q;
|
rphy->q = q;
|
||||||
|
@ -261,6 +265,10 @@ static int sas_bsg_initialize(struct Scsi_Host *shost, struct sas_rphy *rphy)
|
||||||
|
|
||||||
queue_flag_set_unlocked(QUEUE_FLAG_BIDI, q);
|
queue_flag_set_unlocked(QUEUE_FLAG_BIDI, q);
|
||||||
return 0;
|
return 0;
|
||||||
|
|
||||||
|
out_cleanup_queue:
|
||||||
|
blk_cleanup_queue(q);
|
||||||
|
return error;
|
||||||
}
|
}
|
||||||
|
|
||||||
static void sas_bsg_remove(struct Scsi_Host *shost, struct sas_rphy *rphy)
|
static void sas_bsg_remove(struct Scsi_Host *shost, struct sas_rphy *rphy)
|
||||||
|
|
Loading…
Reference in a new issue