Received: by 10.213.65.68 with SMTP id h4csp15459imn; Mon, 19 Mar 2018 17:59:21 -0700 (PDT) X-Google-Smtp-Source: AG47ELte9n0dGWOUidbkWUBgQ61NRVmKOiQ3VuVwgrW7T6AV8pvBXGbtm4rUZPJKd1EEkOHeULhL X-Received: by 2002:a17:902:ab85:: with SMTP id f5-v6mr10696542plr.380.1521507561434; Mon, 19 Mar 2018 17:59:21 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1521507561; cv=none; d=google.com; s=arc-20160816; b=yF8Eplb6ddJT5XcUs8imj2fyKSHCd3HGR9WYN8UMlidErW975PXvlDRVfALuwEfCZ+ tiskeNfS10guHz7pRzrvpvVP8m/463KQkfA5D8nzREOd6jcDSWC70R8Vss+GDMYygH55 Yu7wdjrDalu0jIiqGo+mk8qTXQ7vP/p2Nk1uSNjx3K1TTXbkpexPM6WrhVsRgHsBm0iJ nw9BjXu34499Bpgf477+NWxLvERpQB6BdJlPpsJxDCe4yZday5HfjrD2dunIoMXSFarU G2cu9qASRVfNAgdwgGW4BFOKPprX1pbAmgi51pWHO7W9TEwatGystDkqzjFUvLbAiGgl vjmw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :in-reply-to:message-id:date:subject:cc:to:from :arc-authentication-results; bh=tsInwkYwrdrQAGRbVg7biklDWE1sM8I8330br5EqnQ0=; b=iKNPb4rZJN6J82a4b33OiEMVrZLsuyQuHR8E8VRSu/c+AdN7jqxwIfFGQ/XI9FYiqk 8W6Kvven/b8mxrohJNJ2b+txdjD2/VIvoN1VAfQ+gcs0oQEndABo+DhiTr6fWrN/mmRn gpLH0bmLrchk+l2P63Gurm0jvT6yoIzjwtfAjDl+aUWwSOkVBnW7F3mmpeFGHIQkn2s+ uupv6lkbNLKBftx85cv4FuFTm/tmEJLLOK8QE071Ir9MEywiueHGXwdnp9rj6JGrkBOQ Y80vLiuANPQTK960fU36r4FsPTgegs28nW2rQPnvcdK9X9BNX4io8iMmy4MN2noJmr1n LjPg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id y11-v6si441817plk.353.2018.03.19.17.59.07; Mon, 19 Mar 2018 17:59:21 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1031744AbeCSS2f (ORCPT + 99 others); Mon, 19 Mar 2018 14:28:35 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:52218 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S969931AbeCSS23 (ORCPT ); Mon, 19 Mar 2018 14:28:29 -0400 Received: from localhost (LFbn-1-12247-202.w90-92.abo.wanadoo.fr [90.92.61.202]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id 4D01ED28; Mon, 19 Mar 2018 18:28:29 +0000 (UTC) From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johannes Thumshirn , Jason L Tibbitts III , Doug Gilbert , Hannes Reinecke , "Martin K. Petersen" Subject: [PATCH 4.9 235/241] scsi: sg: only check for dxfer_len greater than 256M Date: Mon, 19 Mar 2018 19:08:20 +0100 Message-Id: <20180319180800.907816485@linuxfoundation.org> X-Mailer: git-send-email 2.16.2 In-Reply-To: <20180319180751.172155436@linuxfoundation.org> References: <20180319180751.172155436@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.9-stable review patch. If anyone has any objections, please let me know. ------------------ From: Johannes Thumshirn commit f930c7043663188429cd9b254e9d761edfc101ce upstream. Don't make any assumptions on the sg_io_hdr_t::dxfer_direction or the sg_io_hdr_t::dxferp in order to determine if it is a valid request. The only way we can check for bad requests is by checking if the length exceeds 256M. Signed-off-by: Johannes Thumshirn Fixes: 28676d869bbb (scsi: sg: check for valid direction before starting the request) Reported-by: Jason L Tibbitts III Tested-by: Jason L Tibbitts III Suggested-by: Doug Gilbert Cc: Doug Gilbert Cc: Reviewed-by: Hannes Reinecke Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman --- drivers/scsi/sg.c | 31 +------------------------------ 1 file changed, 1 insertion(+), 30 deletions(-) --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -751,35 +751,6 @@ sg_new_write(Sg_fd *sfp, struct file *fi return count; } -static bool sg_is_valid_dxfer(sg_io_hdr_t *hp) -{ - switch (hp->dxfer_direction) { - case SG_DXFER_NONE: - if (hp->dxferp || hp->dxfer_len > 0) - return false; - return true; - case SG_DXFER_FROM_DEV: - /* - * for SG_DXFER_FROM_DEV we always set dxfer_len to > 0. dxferp - * can either be NULL or != NULL so there's no point in checking - * it either. So just return true. - */ - return true; - case SG_DXFER_TO_DEV: - case SG_DXFER_TO_FROM_DEV: - if (!hp->dxferp || hp->dxfer_len == 0) - return false; - return true; - case SG_DXFER_UNKNOWN: - if ((!hp->dxferp && hp->dxfer_len) || - (hp->dxferp && hp->dxfer_len == 0)) - return false; - return true; - default: - return false; - } -} - static int sg_common_write(Sg_fd * sfp, Sg_request * srp, unsigned char *cmnd, int timeout, int blocking) @@ -800,7 +771,7 @@ sg_common_write(Sg_fd * sfp, Sg_request "sg_common_write: scsi opcode=0x%02x, cmd_size=%d\n", (int) cmnd[0], (int) hp->cmd_len)); - if (!sg_is_valid_dxfer(hp)) + if (hp->dxfer_len >= SZ_256M) return -EINVAL; k = sg_start_req(srp, cmnd);