Hi Pavel,

Thanks for your work.
I was also working on this.
But the same patch seems to have already been posted by Guenter Roeck.

  https://lore.kernel.org/stable/20200514150551.240275-1-linux@roeck-us.net/

Best regards,
  Nobuhiro

> -----Original Message-----
> From: cip-dev@lists.cip-project.org [mailto:cip-dev@lists.cip-project.org] On Behalf Of Pavel Machek
> Sent: Friday, May 15, 2020 6:56 AM
> To: cip-dev@lists.cip-project.org
> Subject: [cip-dev] CVE-2020-12770: easy backport of sg code
> 
> Hi!
> 
> So let me investigate... Mainline fix is commit 83c6f2390040f188cc25b270b4befeb5628c1aee.
> 
> Backport for 4.19 looks really easy, and I can't see anything wrong
> there:
> 
> commit c45e3bcdebb204ef1ba1d00f41fe7ed39c4dd8cd
> Author: Pavel Machek <pavel@ucw.cz>
> Date:   Thu May 14 23:47:42 2020 +0200
> 
>     Backport.
> 
>     commit 83c6f2390040f188cc25b270b4befeb5628c1aee
>     ...
>         scsi: sg: add sg_remove_request in sg_write
> 
>         If the __copy_from_user function failed we need to call
>         sg_remove_request
>             in sg_write.
> 
>      Link: https://lore.kernel.org/r/610618d9-e983-fd56-ed0f-639428343af7@huawei.com
>      Acked-by: Douglas Gilbert <dgilbert@interlog.com>
>      Signed-off-by: Wu Bo <wubo40@huawei.com>
>      Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
> 
> diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
> index 8a254bb46a9b..4f00d3062bd6 100644
> --- a/drivers/scsi/sg.c
> +++ b/drivers/scsi/sg.c
> @@ -694,8 +694,10 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos)
>  	hp->flags = input_size;	/* structure abuse ... */
>  	hp->pack_id = old_hdr.pack_id;
>  	hp->usr_ptr = NULL;
> -	if (__copy_from_user(cmnd, buf, cmd_size))
> +	if (__copy_from_user(cmnd, buf, cmd_size)) {
> +		sg_remove_request(sfp, srp);
>  		return -EFAULT;
> +	}
>  	/*
>  	 * SG_DXFER_TO_FROM_DEV is functionally equivalent to SG_DXFER_FROM_DEV,
>  	 * but is is possible that the app intended SG_DXFER_TO_DEV, because there
> 
> And I don't see a problem with 4.4, either.
> 
> Best regards,
> 									Pavel
> --
> (english) http://www.livejournal.com/~pavelmachek
> (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html