* [cip-dev] CVE-2020-12770: easy backport of sg code
@ 2020-05-14 21:55 Pavel Machek
2020-05-15 0:46 ` Nobuhiro Iwamatsu
0 siblings, 1 reply; 2+ messages in thread
From: Pavel Machek @ 2020-05-14 21:55 UTC (permalink / raw)
To: cip-dev
[-- Attachment #1.1: Type: text/plain, Size: 1720 bytes --]
Hi!
So let me investigate... Mainline fix is commit 83c6f2390040f188cc25b270b4befeb5628c1aee.
Backport for 4.19 looks really easy, and I can't see anything wrong
there:
commit c45e3bcdebb204ef1ba1d00f41fe7ed39c4dd8cd
Author: Pavel Machek <pavel@ucw.cz>
Date: Thu May 14 23:47:42 2020 +0200
Backport.
commit 83c6f2390040f188cc25b270b4befeb5628c1aee
...
scsi: sg: add sg_remove_request in sg_write
If the __copy_from_user function failed we need to call
sg_remove_request
in sg_write.
Link: https://lore.kernel.org/r/610618d9-e983-fd56-ed0f-639428343af7@huawei.com
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Wu Bo <wubo40@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 8a254bb46a9b..4f00d3062bd6 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -694,8 +694,10 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos)
hp->flags = input_size; /* structure abuse ... */
hp->pack_id = old_hdr.pack_id;
hp->usr_ptr = NULL;
- if (__copy_from_user(cmnd, buf, cmd_size))
+ if (__copy_from_user(cmnd, buf, cmd_size)) {
+ sg_remove_request(sfp, srp);
return -EFAULT;
+ }
/*
* SG_DXFER_TO_FROM_DEV is functionally equivalent to SG_DXFER_FROM_DEV,
* but is is possible that the app intended SG_DXFER_TO_DEV, because there
And I don't see a problem with 4.4, either.
Best regards,
Pavel
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
[-- Attachment #1.2: Digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]
[-- Attachment #2: Type: text/plain, Size: 419 bytes --]
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#4621): https://lists.cip-project.org/g/cip-dev/message/4621
Mute This Topic: https://lists.cip-project.org/mt/74215710/4520388
Group Owner: cip-dev+owner@lists.cip-project.org
Unsubscribe: https://lists.cip-project.org/g/cip-dev/leave/8129055/727948398/xyzzy [cip-dev@archiver.kernel.org]
-=-=-=-=-=-=-=-=-=-=-=-
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [cip-dev] CVE-2020-12770: easy backport of sg code
2020-05-14 21:55 [cip-dev] CVE-2020-12770: easy backport of sg code Pavel Machek
@ 2020-05-15 0:46 ` Nobuhiro Iwamatsu
0 siblings, 0 replies; 2+ messages in thread
From: Nobuhiro Iwamatsu @ 2020-05-15 0:46 UTC (permalink / raw)
To: pavel; +Cc: cip-dev
[-- Attachment #1: Type: text/plain, Size: 2331 bytes --]
Hi Pavel,
Thanks for your work.
I was also working on this.
But the same patch seems to have already been posted by Guenter Roeck.
https://lore.kernel.org/stable/20200514150551.240275-1-linux@roeck-us.net/
Best regards,
Nobuhiro
> -----Original Message-----
> From: cip-dev@lists.cip-project.org [mailto:cip-dev@lists.cip-project.org] On Behalf Of Pavel Machek
> Sent: Friday, May 15, 2020 6:56 AM
> To: cip-dev@lists.cip-project.org
> Subject: [cip-dev] CVE-2020-12770: easy backport of sg code
>
> Hi!
>
> So let me investigate... Mainline fix is commit 83c6f2390040f188cc25b270b4befeb5628c1aee.
>
> Backport for 4.19 looks really easy, and I can't see anything wrong
> there:
>
> commit c45e3bcdebb204ef1ba1d00f41fe7ed39c4dd8cd
> Author: Pavel Machek <pavel@ucw.cz>
> Date: Thu May 14 23:47:42 2020 +0200
>
> Backport.
>
> commit 83c6f2390040f188cc25b270b4befeb5628c1aee
> ...
> scsi: sg: add sg_remove_request in sg_write
>
> If the __copy_from_user function failed we need to call
> sg_remove_request
> in sg_write.
>
> Link: https://lore.kernel.org/r/610618d9-e983-fd56-ed0f-639428343af7@huawei.com
> Acked-by: Douglas Gilbert <dgilbert@interlog.com>
> Signed-off-by: Wu Bo <wubo40@huawei.com>
> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
>
> diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
> index 8a254bb46a9b..4f00d3062bd6 100644
> --- a/drivers/scsi/sg.c
> +++ b/drivers/scsi/sg.c
> @@ -694,8 +694,10 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos)
> hp->flags = input_size; /* structure abuse ... */
> hp->pack_id = old_hdr.pack_id;
> hp->usr_ptr = NULL;
> - if (__copy_from_user(cmnd, buf, cmd_size))
> + if (__copy_from_user(cmnd, buf, cmd_size)) {
> + sg_remove_request(sfp, srp);
> return -EFAULT;
> + }
> /*
> * SG_DXFER_TO_FROM_DEV is functionally equivalent to SG_DXFER_FROM_DEV,
> * but is is possible that the app intended SG_DXFER_TO_DEV, because there
>
> And I don't see a problem with 4.4, either.
>
> Best regards,
> Pavel
> --
> (english) http://www.livejournal.com/~pavelmachek
> (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
[-- Attachment #2: Type: text/plain, Size: 419 bytes --]
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#4622): https://lists.cip-project.org/g/cip-dev/message/4622
Mute This Topic: https://lists.cip-project.org/mt/74215710/4520388
Group Owner: cip-dev+owner@lists.cip-project.org
Unsubscribe: https://lists.cip-project.org/g/cip-dev/leave/8129055/727948398/xyzzy [cip-dev@archiver.kernel.org]
-=-=-=-=-=-=-=-=-=-=-=-
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-05-15 0:46 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-05-14 21:55 [cip-dev] CVE-2020-12770: easy backport of sg code Pavel Machek
2020-05-15 0:46 ` Nobuhiro Iwamatsu
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.