| Message ID | 20200514215552.GA18872@amd (mailing list archive) |
|---|---|
| State | Not Applicable |
| Headers | show |
| Series | CVE-2020-12770: easy backport of sg code | expand |
Hi Pavel, Thanks for your work. I was also working on this. But the same patch seems to have already been posted by Guenter Roeck. https://lore.kernel.org/stable/20200514150551.240275-1-linux@roeck-us.net/ Best regards, Nobuhiro > -----Original Message----- > From: cip-dev@lists.cip-project.org [mailto:cip-dev@lists.cip-project.org] On Behalf Of Pavel Machek > Sent: Friday, May 15, 2020 6:56 AM > To: cip-dev@lists.cip-project.org > Subject: [cip-dev] CVE-2020-12770: easy backport of sg code > > Hi! > > So let me investigate... Mainline fix is commit 83c6f2390040f188cc25b270b4befeb5628c1aee. > > Backport for 4.19 looks really easy, and I can't see anything wrong > there: > > commit c45e3bcdebb204ef1ba1d00f41fe7ed39c4dd8cd > Author: Pavel Machek <pavel@ucw.cz> > Date: Thu May 14 23:47:42 2020 +0200 > > Backport. > > commit 83c6f2390040f188cc25b270b4befeb5628c1aee > ... > scsi: sg: add sg_remove_request in sg_write > > If the __copy_from_user function failed we need to call > sg_remove_request > in sg_write. > > Link: https://lore.kernel.org/r/610618d9-e983-fd56-ed0f-639428343af7@huawei.com > Acked-by: Douglas Gilbert <dgilbert@interlog.com> > Signed-off-by: Wu Bo <wubo40@huawei.com> > Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> > > diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c > index 8a254bb46a9b..4f00d3062bd6 100644 > --- a/drivers/scsi/sg.c > +++ b/drivers/scsi/sg.c > @@ -694,8 +694,10 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos) > hp->flags = input_size; /* structure abuse ... */ > hp->pack_id = old_hdr.pack_id; > hp->usr_ptr = NULL; > - if (__copy_from_user(cmnd, buf, cmd_size)) > + if (__copy_from_user(cmnd, buf, cmd_size)) { > + sg_remove_request(sfp, srp); > return -EFAULT; > + } > /* > * SG_DXFER_TO_FROM_DEV is functionally equivalent to SG_DXFER_FROM_DEV, > * but is is possible that the app intended SG_DXFER_TO_DEV, because there > > And I don't see a problem with 4.4, either. > > Best regards, > Pavel > -- > (english) http://www.livejournal.com/~pavelmachek > (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html -=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#4622): https://lists.cip-project.org/g/cip-dev/message/4622 Mute This Topic: https://lists.cip-project.org/mt/74215710/4520428 Group Owner: cip-dev+owner@lists.cip-project.org Unsubscribe: https://lists.cip-project.org/g/cip-dev/leave/8129116/1171672734/xyzzy [patchwork-cip-dev@patchwork.kernel.org] -=-=-=-=-=-=-=-=-=-=-=-
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c index 8a254bb46a9b..4f00d3062bd6 100644 --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -694,8 +694,10 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos) hp->flags = input_size; /* structure abuse ... */ hp->pack_id = old_hdr.pack_id; hp->usr_ptr = NULL; - if (__copy_from_user(cmnd, buf, cmd_size)) + if (__copy_from_user(cmnd, buf, cmd_size)) { + sg_remove_request(sfp, srp); return -EFAULT; + } /* * SG_DXFER_TO_FROM_DEV is functionally equivalent to SG_DXFER_FROM_DEV, * but is is possible that the app intended SG_DXFER_TO_DEV, because there
Hi! So let me investigate... Mainline fix is commit 83c6f2390040f188cc25b270b4befeb5628c1aee. Backport for 4.19 looks really easy, and I can't see anything wrong there: commit c45e3bcdebb204ef1ba1d00f41fe7ed39c4dd8cd Author: Pavel Machek <pavel@ucw.cz> Date: Thu May 14 23:47:42 2020 +0200 Backport. commit 83c6f2390040f188cc25b270b4befeb5628c1aee ... scsi: sg: add sg_remove_request in sg_write If the __copy_from_user function failed we need to call sg_remove_request in sg_write. Link: https://lore.kernel.org/r/610618d9-e983-fd56-ed0f-639428343af7@huawei.com Acked-by: Douglas Gilbert <dgilbert@interlog.com> Signed-off-by: Wu Bo <wubo40@huawei.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> And I don't see a problem with 4.4, either. Best regards, Pavel