Re: [PATCH 5.10 1/2] nvme: restrict management ioctls to admin

[Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>]

Hi Ovidiu,

On 22/11/22 3:52 pm, Ovidiu Panait wrote:
> From: Keith Busch <kbusch@kernel.org>
> 
> commit 23e085b2dead13b51fe86d27069895b740f749c0 upstream.
> 
> The passthrough commands already have this restriction, but the other
> operations do not. Require the same capabilities for all users as all of
> these operations, which include resets and rescans, can be disruptive.
> 
> Signed-off-by: Keith Busch <kbusch@kernel.org>
> Signed-off-by: Christoph Hellwig <hch@lst.de>
> Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
> ---
> These backports are for CVE-2022-3169.
> 
>   drivers/nvme/host/core.c | 6 ++++++
>   1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
> index 3f106771d15b..d9c78fe85cb3 100644
> --- a/drivers/nvme/host/core.c
> +++ b/drivers/nvme/host/core.c
> @@ -3330,11 +3330,17 @@ static long nvme_dev_ioctl(struct file *file, unsigned int cmd,
>   	case NVME_IOCTL_IO_CMD:
>   		return nvme_dev_user_cmd(ctrl, argp);
>   	case NVME_IOCTL_RESET:
> +		if (!capable(CAP_SYS_ADMIN))
> +			return -EACCES;
>   		dev_warn(ctrl->device, "resetting controller\n");
>   		return nvme_reset_ctrl_sync(ctrl);
>   	case NVME_IOCTL_SUBSYS_RESET:
> +		if (!capable(CAP_SYS_ADMIN))
> +			return -EACCES;
>   		return nvme_reset_subsystem(ctrl);
>   	case NVME_IOCTL_RESCAN:
> +		if (!capable(CAP_SYS_ADMIN))
> +			return -EACCES;
>   		nvme_queue_scan(ctrl);
>   		return 0;
>   	default:

Should we apply this patch(1/2) to other stable releases as well, i.e. 
5.4, 4.19, 4.14 ?

This first patch applies cleanly there as well(5.4,4.19,4.14).

Thanks,
Harshit