mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-02 23:27:06 +00:00
Code Issues Releases Wiki Activity
linux-stable/drivers/scsi
History
Jens Axboe cb101349f5 sr: pass down correctly sized SCSI sense buffer 
commit f7068114d4 upstream.

We're casting the CDROM layer request_sense to the SCSI sense
buffer, but the former is 64 bytes and the latter is 96 bytes.
As we generally allocate these on the stack, we end up blowing
up the stack.

Fix this by wrapping the scsi_execute() call with a properly
sized sense buffer, and copying back the bits for the CDROM
layer.

Reported-by: Piotr Gabriel Kosinski <pg.kosinski@gmail.com>
Reported-by: Daniel Shapira <daniel@twistlock.com>
Tested-by: Kees Cook <keescook@chromium.org>
Fixes: 82ed4db499 ("block: split scsi_request out of struct request")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
[bwh: Despite what the "Fixes" field says, a buffer overrun was already
 possible if the sense data was really > 64 bytes long.
 Backported to 4.9:
 - We always need to allocate a sense buffer in order to call
   scsi_normalize_sense()
 - Remove the existing conditional heap-allocation of the sense buffer]
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2018-12-13 09:20:29 +01:00
..
aacraid scsi: aacraid: Fix typo in blink status 2018-11-10 07:42:45 -08:00
aic7xxx aic7xxx: Fix queue depth handling 2016-02-23 21:27:02 -05:00
aic94xx scsi: aic94xx: fix an error code in aic94xx_init() 2018-09-15 09:42:59 +02:00
arcmsr scsi: arcmsr: Send SYNCHRONIZE_CACHE command to firmware 2016-10-26 22:17:43 -04:00
arm scsi: fas216: fix sense buffer initialization 2018-05-25 16:13:06 +02:00
be2iscsi scsi: be2iscsi: Check tag in beiscsi_mccq_compl_wait 2018-03-22 09:17:43 +01:00
bfa scsi: bfa: convert to strlcpy/strlcat 2018-12-08 13:05:05 +01:00
bnx2fc scsi: bnx2fc: Fix check in SCSI completion handler for timed out request 2018-05-25 16:13:06 +02:00
bnx2i scsi: bnx2i: add error handling for ioremap_nocache 2018-10-03 17:01:48 -07:00
csiostor scsi: csiostor: Avoid content leaks and casts 2018-12-08 13:05:06 +01:00
cxgbi scsi: cxgb4i: fix Tx skb leak 2017-12-25 14:23:44 +01:00
cxlflash scsi: cxlflash: Fix context reference tracking on detach 2016-09-14 12:47:42 -04:00
device_handler scsi: scsi_dh_emc: return success in clariion_std_inquiry() 2017-10-21 17:21:36 +02:00
dpt
esas2r scsi: esas2r: don't reinitialize adapter's req_table 2016-08-25 22:28:17 -04:00
fcoe scsi: fcoe: drop frames in ELS LOGO error path 2018-09-05 09:20:04 +02:00
fnic scsi: fnic: Fix for "Number of Active IOs" in fnicstats becoming negative 2018-03-22 09:17:41 +01:00
hisi_sas scsi: hisi_sas: send three identify before phy up 2016-09-14 12:54:18 -04:00
ibmvscsi scsi: ibmvscsi: Improve strings handling 2018-10-03 17:01:45 -07:00
ibmvscsi_tgt scsi: ibmvscsis: Ensure partition name is properly NUL terminated 2018-10-20 09:51:30 +02:00
isci scsi: isci: avoid array subscript warning 2017-09-02 07:07:53 +02:00
libfc scsi: fcoe: clear FC_RP_STARTED flags when receiving a LOGO 2018-09-05 09:20:04 +02:00
libsas scsi: libsas: defer ata device eh commands to libata 2018-05-25 16:12:58 +02:00
lpfc scsi: lpfc: Correct soft lockup when running mds diagnostics 2018-11-13 11:16:53 -08:00
megaraid scsi: megaraid_sas: fix a missing-check bug 2018-11-13 11:16:52 -08:00
mpt3sas scsi: mpt3sas: Do not mark fw_event workqueue as WQ_MEM_RECLAIM 2018-05-25 16:13:07 +02:00
mvsas scsi: mvsas: fix wrong endianness of sgpio api 2018-05-25 16:13:08 +02:00
osd scsi/osd: open code blk_make_request 2016-07-20 17:38:35 -06:00
pcmcia scsi: Do not set cmd_per_lun to 1 in the host template 2015-05-31 18:06:28 -07:00
pm8001 scsi: pm8001: Mark symbols static where possible 2016-09-26 21:10:45 -04:00
qla2xxx scsi: qla2xxx: shutdown chip if reset fail 2018-11-21 09:25:57 +01:00
qla4xxx scsi: qla4xxx: skip error recovery in case of register disconnect. 2018-05-25 16:13:07 +02:00
smartpqi scsi: smartpqi: allow static build ("built-in") 2018-02-22 15:43:47 +01:00
snic scsi: snic: Return error code on memory allocation failure 2017-08-06 18:59:49 -07:00
sym53c8xx_2 scsi: sym53c8xx_2: iterator underflow in sym_getsync() 2018-05-25 16:13:06 +02:00
ufs scsi: ufshcd: release resources if probe fails 2018-12-01 09:44:25 +01:00
.gitignore
3w-9xxx.c scsi: 3ware: fix return 0 on the error path of probe 2018-09-19 22:47:14 +02:00
3w-9xxx.h 3w-9xxx: fix command completion race 2015-04-27 10:10:19 -07:00
3w-sas.c scsi: 3ware: fix return 0 on the error path of probe 2018-09-19 22:47:14 +02:00
3w-sas.h 3w-sas: fix command completion race 2015-04-27 10:04:39 -07:00
3w-xxxx.c scsi: 3ware: fix return 0 on the error path of probe 2018-09-19 22:47:14 +02:00
3w-xxxx.h 3w-xxxx: fix command completion race 2015-04-27 10:05:55 -07:00
53c700.c scsi: remove current_cmnd field from struct scsi_device 2016-07-13 22:33:23 -04:00
53c700.h scsi: remove current_cmnd field from struct scsi_device 2016-07-13 22:33:23 -04:00
53c700.scr
53c700_d.h_shipped
a100u2w.c scsi: a100u2w: trivial typo in printk 2015-08-07 15:03:42 +02:00
a100u2w.h
a2091.c
a2091.h
a3000.c
a3000.h
a4000t.c
advansys.c scsi: advansys: fix uninitialized data access 2018-02-25 11:05:53 +01:00
aha152x.c scsi: Do not set cmd_per_lun to 1 in the host template 2015-05-31 18:06:28 -07:00
aha152x.h
aha1542.c scsi: aha1542: avoid uninitialized variable warnings 2016-02-23 21:27:02 -05:00
aha1542.h aha1542: fix include guard and remove useless changelog 2015-04-09 18:08:31 -07:00
aha1740.c scsi: Do not set cmd_per_lun to 1 in the host template 2015-05-31 18:06:28 -07:00
aha1740.h scsi: Do not set cmd_per_lun to 1 in the host template 2015-05-31 18:06:28 -07:00
am53c974.c am53c974: Fix crash during modprobe 2015-04-17 10:13:56 -07:00
atari_scsi.c atari_scsi: Allow can_queue to be increased for Falcon 2016-04-11 16:57:09 -04:00
atp870u.c atp870u: Introduce atp870_init() 2015-11-25 22:08:55 -05:00
atp870u.h atp870u: Remove scam_on from struct atp_unit 2015-11-25 22:08:52 -05:00
BusLogic.c
BusLogic.h
bvme6000_scsi.c
ch.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial 2015-04-14 09:50:27 -07:00
constants.c scsi: fix upper bounds check of sense key in scsi_sense_key_string() 2016-08-16 00:49:32 -04:00
dc395x.c
dc395x.h
dmx3191d.c ncr5380: Remove DONT_USE_INTR and AUTOPROBE_IRQ macros 2016-04-11 16:57:09 -04:00
dpt_i2o.c dpt_i2o: fix build warning 2016-02-23 21:27:02 -05:00
dpti.h
eata.c
eata_generic.h
eata_pio.c eata_pio: missing break statement 2016-05-10 22:01:07 -04:00
eata_pio.h
esp_scsi.c scsi: esp_scsi: Track residual for PIO transfers 2018-11-13 11:16:51 -08:00
esp_scsi.h scsi: esp_scsi: Track residual for PIO transfers 2018-11-13 11:16:51 -08:00
fdomain.c scsi: fdomain: drop fdomain_pci_tbl when built-in 2016-02-23 21:27:02 -05:00
fdomain.h
FlashPoint.c FlashPoint: fix build warning 2015-11-09 16:32:14 -08:00
g_NCR5380.c scsi: g_NCR5380: Fix release_region in error handling 2017-01-12 11:39:29 +01:00
g_NCR5380.h scsi: g_NCR5380: Stop using scsi_module.c 2016-09-29 21:52:43 -04:00
g_NCR5380_mmio.c
gdth.c gdth: replace struct timeval with ktime_get_real_seconds() 2016-02-25 21:16:49 -05:00
gdth.h
gdth_ioctl.h
gdth_proc.c gdth: replace struct timeval with ktime_get_real_seconds() 2016-02-25 21:16:49 -05:00
gdth_proc.h
gvp11.c
gvp11.h
hosts.c SCSI misc on 20161006 2016-10-07 09:28:53 -07:00
hpsa.c scsi: hpsa: fix volume offline state 2018-01-23 19:57:05 +01:00
hpsa.h scsi: hpsa: limit outstanding rescans 2017-12-20 10:07:22 +01:00
hpsa_cmd.h scsi: hpsa: update check for logical volume status 2017-12-20 10:07:22 +01:00
hptiop.c hptiop: Support HighPoint RR36xx HBAs and Support SAS tape and SAS media changer 2015-08-12 13:14:57 -07:00
hptiop.h hptiop: Support HighPoint RR36xx HBAs and Support SAS tape and SAS media changer 2015-08-12 13:14:57 -07:00
imm.c imm: check parport_claim 2016-02-25 21:10:53 -05:00
imm.h
initio.c SCSI: initio: remove duplicate module device table 2015-11-20 11:39:03 -05:00
initio.h
ipr.c scsi: ipr: Fix missed EH wakeup 2018-03-22 09:17:42 +01:00
ipr.h scsi: ipr: Don't log unnecessary 9084 error details 2016-09-19 11:57:33 -04:00
ips.c ips: remove pointless #warning 2015-06-02 17:24:54 -07:00
ips.h
iscsi_boot_sysfs.c ibft: Expose iBFT acpi header via sysfs 2016-05-16 11:14:29 -04:00
iscsi_tcp.c scsi_tcp: block BH in TCP callbacks 2016-05-19 11:36:49 -07:00
iscsi_tcp.h iscsi_tcp: Use ahash 2016-01-27 20:36:10 +08:00
jazz_esp.c
Kconfig scsi: mac_scsi: Fix MAC_SCSI=m option when SCSI=m 2017-05-14 14:00:19 +02:00
lasi700.c
libiscsi.c scsi: libiscsi: fix possible NULL pointer dereference in case of TMF 2018-09-05 09:20:00 +02:00
libiscsi_tcp.c iscsi_tcp: Use ahash 2016-01-27 20:36:10 +08:00
mac53c94.c PCI: Remove includes of asm/pci-bridge.h 2016-02-05 16:29:28 -06:00
mac53c94.h
mac_esp.c scsi: esp_scsi: Track residual for PIO transfers 2018-11-13 11:16:51 -08:00
mac_scsi.c mac_scsi: Fix pseudo DMA implementation 2016-04-11 16:57:09 -04:00
Makefile scsi: dtc: remove from tree 2016-09-26 20:49:25 -04:00
megaraid.c scsi: megaraid: silence a static checker bug 2018-08-03 07:55:23 +02:00
megaraid.h
mesh.c PCI: Remove includes of asm/pci-bridge.h 2016-02-05 16:29:28 -06:00
mesh.h
mvme16x_scsi.c
mvme147.c
mvme147.h
mvumi.c scsi: mvumi: use __maybe_unused to hide pm functions 2016-03-05 17:07:46 -05:00
mvumi.h
ncr53c8xx.c
ncr53c8xx.h
NCR53c406a.c scsi: Do not set cmd_per_lun to 1 in the host template 2015-05-31 18:06:28 -07:00
NCR5380.c scsi: NCR5380: no longer mark irq probing as __init 2016-10-17 14:13:03 -04:00
NCR5380.h scsi: ncr5380: Improve interrupt latency during PIO tranfers 2016-09-14 14:11:12 -04:00
NCR_D700.c
NCR_D700.h
NCR_Q720.c
NCR_Q720.h
nsp32.c scsi: Do not set cmd_per_lun to 1 in the host template 2015-05-31 18:06:28 -07:00
nsp32.h
nsp32_debug.c
nsp32_io.h
osst.c
osst.h
osst_detect.h
osst_options.h
pmcraid.c scsi: pmcraid: mark symbols static where possible 2016-09-04 01:28:07 -04:00
pmcraid.h
ppa.c scsi: ppa: use new parport device model 2016-02-23 21:27:02 -05:00
ppa.h
ps3rom.c scsi: Do not set cmd_per_lun to 1 in the host template 2015-05-31 18:06:28 -07:00
qla1280.c qla1280: Don't allocate 512kb of host tags 2016-04-30 09:25:26 -07:00
qla1280.h
qlogicfas.c scsi: Do not set cmd_per_lun to 1 in the host template 2015-05-31 18:06:28 -07:00
qlogicfas408.c
qlogicfas408.h
qlogicpti.c qlogicpti: Return correct error code 2016-03-01 20:06:49 -05:00
qlogicpti.h qlogicpti: Fix compiler warnings 2016-11-28 15:51:31 -05:00
raid_class.c
script_asm.pl
scsi.c scsi: Avoid that toggling use_blk_mq triggers a memory leak 2016-09-26 20:58:42 -04:00
scsi.h
scsi_common.c scsi: add scsi_set_sense_field_pointer() 2016-04-04 12:07:42 -04:00
scsi_debug.c scsi: scsi_debug: write_same: fix error report 2017-12-20 10:07:30 +01:00
scsi_devinfo.c scsi: scsi_devinfo: cleanly zero-pad devinfo strings 2018-12-08 13:05:06 +01:00
scsi_dh.c scsi: scsi_dh: replace too broad "TP9" string with the exact models 2018-08-03 07:55:25 +02:00
scsi_error.c Merge remote-tracking branch 'mkp-scsi/4.7/scsi-fixes' into fixes 2016-06-18 11:59:01 -07:00
scsi_ioctl.c
scsi_lib.c scsi: use dma_get_cache_alignment() as minimum DMA alignment 2017-12-14 09:28:11 +01:00
scsi_lib_dma.c
scsi_logging.c
scsi_logging.h
scsi_module.c
scsi_netlink.c
scsi_pm.c scsi: Set request queue runtime PM status back to active on resume 2016-02-19 10:52:45 -05:00
scsi_priv.h SCSI misc on 20161006 2016-10-07 09:28:53 -07:00
scsi_proc.c scsi: disable automatic target scan 2016-04-11 16:57:09 -04:00
scsi_sas_internal.h scsi_transport_sas: add 'scsi_target_id' sysfs attribute 2016-03-14 21:05:04 -04:00
scsi_scan.c scsi: Add STARGET_CREATED_REMOVE state to scsi_target_state 2017-07-27 15:07:59 -07:00
scsi_sysctl.c
scsi_sysfs.c scsi: core: Avoid that SCSI device removal through sysfs triggers a deadlock 2018-09-05 09:20:10 +02:00
scsi_trace.c scsi-trace: define ZBC_IN and ZBC_OUT 2016-04-11 16:57:09 -04:00
scsi_transport_api.h
scsi_transport_fc.c scsi_transport_fc: Unexport scsi_is_fc_vport() 2016-04-11 16:57:09 -04:00
scsi_transport_iscsi.c scsi: scsi_transport_iscsi: fix the issue that iscsi_if_rx doesn't parse nlmsg properly 2017-10-05 09:43:59 +02:00
scsi_transport_sas.c scsi: sas: remove is_sas_attached() 2016-08-18 22:23:20 -04:00
scsi_transport_spi.c [SCSI] Fix printk typos in drivers/scsi 2015-08-07 14:28:45 +02:00
scsi_transport_srp.c scsi: scsi_transport_srp: Fix shost to rport translation 2018-06-06 16:44:38 +02:00
scsi_typedefs.h
scsicam.c
sd.c scsi: sd: don't crash the host on invalid commands 2018-10-20 09:51:31 +02:00
sd.h scsi: sd: Move DIF protection types to t10-pi.h 2016-09-15 09:51:14 -04:00
sd_dif.c scsi: sd: Move DIF protection types to t10-pi.h 2016-09-15 09:51:14 -04:00
sense_codes.h scsi: move Additional Sense Codes to separate file 2016-04-11 16:57:09 -04:00
ses.c scsi: ses: don't ask for diagnostic pages repeatedly during probe 2018-03-22 09:17:55 +01:00
sg.c scsi: sg: fix minor memory leak in error path 2018-08-06 16:23:04 +02:00
sgiwd93.c
sim710.c scsi: sim710: fix build warning 2016-02-23 21:27:02 -05:00
sni_53c710.c
sr.c scsi: sr: Avoid that opening a CD-ROM hangs with runtime power management enabled 2018-08-15 18:14:42 +02:00
sr.h
sr_ioctl.c sr: pass down correctly sized SCSI sense buffer 2018-12-13 09:20:29 +01:00
sr_vendor.c
st.c mm: replace get_user_pages_unlocked() write/force parameters with gup_flags 2016-10-18 14:13:37 -07:00
st.h st: Remove obsolete scsi_tape.max_pfn 2015-11-18 11:59:09 -05:00
st_options.h
stex.c stex: Add S3/S4 support 2016-02-23 21:27:02 -05:00
storvsc_drv.c scsi: storvsc: Increase cmd_per_lun for higher speed devices 2018-05-25 16:13:07 +02:00
sun3_scsi.c ncr5380: Remove disused atari_NCR5380.c core driver 2016-04-11 16:57:09 -04:00
sun3_scsi.h
sun3_scsi_vme.c
sun3x_esp.c arch, drivers: don't include <asm/io.h> directly, use <linux/io.h> instead 2015-08-10 23:07:05 -04:00
sun_esp.c
sym53c416.c scsi: Do not set cmd_per_lun to 1 in the host template 2015-05-31 18:06:28 -07:00
sym53c416.h
virtio_scsi.c scsi: virtio_scsi: always read VPD pages for multiqueue too 2018-04-08 12:12:50 +02:00
vmw_pvscsi.c scsi: vmw_pvscsi: Return DID_RESET for status SAM_STAT_COMMAND_TERMINATED 2018-09-05 09:20:04 +02:00
vmw_pvscsi.h scsi: vmw_pvscsi: return SUCCESS for successful command aborts 2016-11-01 13:31:23 -04:00
wd33c93.c
wd33c93.h
wd719x.c drivers/scsi/wd719x.c: remove last declaration using DEFINE_PCI_DEVICE_TABLE 2016-09-01 17:52:01 -07:00
wd719x.h scsi: Do not set cmd_per_lun to 1 in the host template 2015-05-31 18:06:28 -07:00
xen-scsifront.c scsi: xen-scsifront: add error handling for xenbus_printf 2018-08-24 13:12:29 +02:00
zalon.c
zorro7xx.c