* [PATCH] libata: reject passthrough WRITE SAME requests
@ 2017-04-25 11:39 Christoph Hellwig
2017-04-25 16:31 ` Martin K. Petersen
2017-04-28 22:09 ` Tejun Heo
0 siblings, 2 replies; 3+ messages in thread
From: Christoph Hellwig @ 2017-04-25 11:39 UTC (permalink / raw)
To: tj; +Cc: linux-ide, stable
The WRITE SAME to TRIM translation rewrites the DATA OUT buffer. While
the SCSI code accomodates for this by passing a read-writable buffer
userspace applications don't cater for this behavior. In fact it can
be used to rewrite e.g. a readonly file through mmap and should be
considered as a security fix.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Cc: stable@vger.kernel.org
---
drivers/ata/libata-scsi.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 1ac70744ae7b..50f56d066936 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -3462,6 +3462,14 @@ static unsigned int ata_scsi_write_same_xlat(struct ata_queued_cmd *qc)
if (unlikely(!dev->dma_mode))
goto invalid_opcode;
+ /*
+ * We only allow sending this command through the block layer,
+ * as it modifies the DATA OUT buffer, which would corrupt user
+ * memory for SG_IO commands.
+ */
+ if (unlikely(blk_rq_is_passthrough(scmd->request)))
+ goto invalid_opcode;
+
if (unlikely(scmd->cmd_len < 16)) {
fp = 15;
goto invalid_fld;
--
2.11.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] libata: reject passthrough WRITE SAME requests
2017-04-25 11:39 [PATCH] libata: reject passthrough WRITE SAME requests Christoph Hellwig
@ 2017-04-25 16:31 ` Martin K. Petersen
2017-04-28 22:09 ` Tejun Heo
1 sibling, 0 replies; 3+ messages in thread
From: Martin K. Petersen @ 2017-04-25 16:31 UTC (permalink / raw)
To: Christoph Hellwig; +Cc: tj, linux-ide, stable
Christoph,
> The WRITE SAME to TRIM translation rewrites the DATA OUT buffer. While
> the SCSI code accomodates for this by passing a read-writable buffer
> userspace applications don't cater for this behavior. In fact it can
> be used to rewrite e.g. a readonly file through mmap and should be
> considered as a security fix.
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
--
Martin K. Petersen Oracle Linux Engineering
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] libata: reject passthrough WRITE SAME requests
2017-04-25 11:39 [PATCH] libata: reject passthrough WRITE SAME requests Christoph Hellwig
2017-04-25 16:31 ` Martin K. Petersen
@ 2017-04-28 22:09 ` Tejun Heo
1 sibling, 0 replies; 3+ messages in thread
From: Tejun Heo @ 2017-04-28 22:09 UTC (permalink / raw)
To: Christoph Hellwig; +Cc: linux-ide, stable
On Tue, Apr 25, 2017 at 01:39:54PM +0200, Christoph Hellwig wrote:
> The WRITE SAME to TRIM translation rewrites the DATA OUT buffer. While
> the SCSI code accomodates for this by passing a read-writable buffer
> userspace applications don't cater for this behavior. In fact it can
> be used to rewrite e.g. a readonly file through mmap and should be
> considered as a security fix.
>
> Signed-off-by: Christoph Hellwig <hch@lst.de>
> Cc: stable@vger.kernel.org
Applied to libata/for-4.12, assuming we aren't doing rc9.
Thanks.
--
tejun
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-04-28 22:09 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-04-25 11:39 [PATCH] libata: reject passthrough WRITE SAME requests Christoph Hellwig
2017-04-25 16:31 ` Martin K. Petersen
2017-04-28 22:09 ` Tejun Heo
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.