All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Pavel Machek" <pavel@ucw.cz>
To: cip-dev@lists.cip-project.org
Subject: [cip-dev] CVE-2020-12770: easy backport of sg code
Date: Thu, 14 May 2020 23:55:52 +0200	[thread overview]
Message-ID: <20200514215552.GA18872@amd> (raw)


[-- Attachment #1.1: Type: text/plain, Size: 1720 bytes --]

Hi!

So let me investigate... Mainline fix is commit 83c6f2390040f188cc25b270b4befeb5628c1aee.

Backport for 4.19 looks really easy, and I can't see anything wrong
there:

commit c45e3bcdebb204ef1ba1d00f41fe7ed39c4dd8cd
Author: Pavel Machek <pavel@ucw.cz>
Date:   Thu May 14 23:47:42 2020 +0200

    Backport.
    
    commit 83c6f2390040f188cc25b270b4befeb5628c1aee
    ...
        scsi: sg: add sg_remove_request in sg_write
    
        If the __copy_from_user function failed we need to call
        sg_remove_request
            in sg_write.
    
     Link: https://lore.kernel.org/r/610618d9-e983-fd56-ed0f-639428343af7@huawei.com
     Acked-by: Douglas Gilbert <dgilbert@interlog.com>
     Signed-off-by: Wu Bo <wubo40@huawei.com>
     Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 8a254bb46a9b..4f00d3062bd6 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -694,8 +694,10 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos)
 	hp->flags = input_size;	/* structure abuse ... */
 	hp->pack_id = old_hdr.pack_id;
 	hp->usr_ptr = NULL;
-	if (__copy_from_user(cmnd, buf, cmd_size))
+	if (__copy_from_user(cmnd, buf, cmd_size)) {
+		sg_remove_request(sfp, srp);
 		return -EFAULT;
+	}
 	/*
 	 * SG_DXFER_TO_FROM_DEV is functionally equivalent to SG_DXFER_FROM_DEV,
 	 * but is is possible that the app intended SG_DXFER_TO_DEV, because there

And I don't see a problem with 4.4, either.

Best regards,
									Pavel
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

[-- Attachment #1.2: Digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

[-- Attachment #2: Type: text/plain, Size: 419 bytes --]

-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.

View/Reply Online (#4621): https://lists.cip-project.org/g/cip-dev/message/4621
Mute This Topic: https://lists.cip-project.org/mt/74215710/4520388
Group Owner: cip-dev+owner@lists.cip-project.org
Unsubscribe: https://lists.cip-project.org/g/cip-dev/leave/8129055/727948398/xyzzy  [cip-dev@archiver.kernel.org]
-=-=-=-=-=-=-=-=-=-=-=-

             reply	other threads:[~2020-05-14 21:56 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-05-14 21:55 Pavel Machek [this message]
2020-05-15  0:46 ` Nobuhiro Iwamatsu

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200514215552.GA18872@amd \
    --to=pavel@ucw.cz \
    --cc=cip-dev@lists.cip-project.org \
    --subject='Re: [cip-dev] CVE-2020-12770: easy backport of sg code' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.