2017-07-27 07:11:43

by Johannes Thumshirn

Subject: [PATCH] scsi: sg: only check for dxfer_len greater than 256M

Don't make any assumptions on the sg_io_hdr_t::dxfer_direction or the
sg_io_hdr_t::dxferp in order to determine if it is a valid request. The
only way we can check for bad requests is by checking if the length exceeds
256M.

Signed-off-by: Johannes Thumshirn <[email protected]>
Fixes: 28676d869bbb (scsi: sg: check for valid direction before starting the
request)
Reported-by: Jason L Tibbitts III <[email protected]>
Tested-by: Jason L Tibbitts III <[email protected]>
Suggested-by: Doug Gilbert <[email protected]>
Cc: Doug Gilbert <[email protected]>
Cc: <[email protected]>
---
drivers/scsi/sg.c | 31 +------------------------------
1 file changed, 1 insertion(+), 30 deletions(-)

diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 4fe606b000b4..d7ff71e0c85c 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -751,35 +751,6 @@ sg_new_write(Sg_fd *sfp, struct file *file, const char __user *buf,
return count;
}

-static bool sg_is_valid_dxfer(sg_io_hdr_t *hp)
-{
- switch (hp->dxfer_direction) {
- case SG_DXFER_NONE:
- if (hp->dxferp || hp->dxfer_len > 0)
- return false;
- return true;
- case SG_DXFER_FROM_DEV:
- /*
- * for SG_DXFER_FROM_DEV we always set dxfer_len to > 0. dxferp
- * can either be NULL or != NULL so there's no point in checking
- * it either. So just return true.
- */
- return true;
- case SG_DXFER_TO_DEV:
- case SG_DXFER_TO_FROM_DEV:
- if (!hp->dxferp || hp->dxfer_len == 0)
- return false;
- return true;
- case SG_DXFER_UNKNOWN:
- if ((!hp->dxferp && hp->dxfer_len) ||
- (hp->dxferp && hp->dxfer_len == 0))
- return false;
- return true;
- default:
- return false;
- }
-}
-
static int
sg_common_write(Sg_fd * sfp, Sg_request * srp,
unsigned char *cmnd, int timeout, int blocking)
@@ -800,7 +771,7 @@ sg_common_write(Sg_fd * sfp, Sg_request * srp,
"sg_common_write: scsi opcode=0x%02x, cmd_size=%d\n",
(int) cmnd[0], (int) hp->cmd_len));

- if (!sg_is_valid_dxfer(hp))
+ if (hp->dxfer_len >= SZ_256M)
return -EINVAL;

k = sg_start_req(srp, cmnd);
--
2.12.3

2017-07-27 08:43:19

by Hannes Reinecke

Subject: Re: [PATCH] scsi: sg: only check for dxfer_len greater than 256M

On 07/27/2017 09:11 AM, Johannes Thumshirn wrote:
> Don't make any assumptions on the sg_io_hdr_t::dxfer_direction or the
> sg_io_hdr_t::dxferp in order to determine if it is a valid request. The
> only way we can check for bad requests is by checking if the length exceeds
> 256M.
>
> Signed-off-by: Johannes Thumshirn <[email protected]>
> Fixes: 28676d869bbb (scsi: sg: check for valid direction before starting the
> request)
> Reported-by: Jason L Tibbitts III <[email protected]>
> Tested-by: Jason L Tibbitts III <[email protected]>
> Suggested-by: Doug Gilbert <[email protected]>
> Cc: Doug Gilbert <[email protected]>
> Cc: <[email protected]>
> ---
> drivers/scsi/sg.c | 31 +------------------------------
> 1 file changed, 1 insertion(+), 30 deletions(-)
>
Reviewed-by: Hannes Reinecke <[email protected]>

Cheers,

Hannes
--
Dr. Hannes Reinecke Teamlead Storage & Networking
[email protected] +49 911 74053 688
SUSE LINUX GmbH, Maxfeldstr. 5, 90409 Nürnberg
GF: F. Imendörffer, J. Smithard, J. Guild, D. Upmanyu, G. Norton
HRB 21284 (AG Nürnberg)

2017-07-27 12:52:14

by Martin K. Petersen

Subject: Re: [PATCH] scsi: sg: only check for dxfer_len greater than 256M

Johannes,

> Don't make any assumptions on the sg_io_hdr_t::dxfer_direction or the
> sg_io_hdr_t::dxferp in order to determine if it is a valid
> request. The only way we can check for bad requests is by checking if
> the length exceeds 256M.

Applied to 4.13/scsi-fixes. Thanks!

--
Martin K. Petersen Oracle Linux Engineering

2017-07-27 13:05:24

by Jason L Tibbitts III

Subject: Re: [PATCH] scsi: sg: only check for dxfer_len greater than 256M

>>>>> "MKP" == Martin K Petersen <[email protected]> writes:

MKP> Applied to 4.13/scsi-fixes. Thanks!

My thanks as well to everyone who helped in getting this fixed.

- J<