From: Nick Desaulniers <ndesaulniers@google.com>
To: unlisted-recipients:; (no To-header on input)
Cc: hare@suse.de, jthumshirn@suse.de, hch@lst.de, salyzyn@google.com,
gregkh@linuxfoundation.org, Robb Glasser <rglasser@google.com>,
Nick Desaulniers <ndesaulniers@google.com>,
Doug Gilbert <dgilbert@interlog.com>,
"James E.J. Bottomley" <jejb@linux.vnet.ibm.com>,
"Martin K. Petersen" <martin.petersen@oracle.com>,
linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH] scsi: sg: Prevent potential double frees in sg driver
Date: Thu, 3 Aug 2017 12:02:47 -0700 [thread overview]
Message-ID: <20170803190248.51537-1-ndesaulniers@google.com> (raw)
From: Robb Glasser <rglasser@google.com>
sg_ioctl could be spammed by requests, leading to a double free in
__free_pages. This protects the entry points of sg_ioctl where the
memory could be corrupted by a double call to __free_pages if multiple
requests are happening concurrently.
Signed-off-by: Robb Glasser <rglasser@google.com>
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
---
drivers/scsi/sg.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 4fe606b000b4..40fe71f4c863 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -883,8 +883,10 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
return -ENXIO;
if (!access_ok(VERIFY_WRITE, p, SZ_SG_IO_HDR))
return -EFAULT;
+ mutex_lock(&sfp->parentdp->open_rel_lock);
result = sg_new_write(sfp, filp, p, SZ_SG_IO_HDR,
1, read_only, 1, &srp);
+ mutex_unlock(&sfp->parentdp->open_rel_lock);
if (result < 0)
return result;
result = wait_event_interruptible(sfp->read_wait,
--
2.14.0.rc1.383.gd1ce394fe2-goog
next reply other threads:[~2017-08-03 19:03 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-08-03 19:02 Nick Desaulniers [this message]
2017-08-03 19:23 ` [PATCH] scsi: sg: Prevent potential double frees in sg driver Greg KH
2017-08-03 19:34 ` Nick Desaulniers
2017-08-03 19:51 ` Greg KH
2017-08-05 11:37 ` Christoph Hellwig
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170803190248.51537-1-ndesaulniers@google.com \
--to=ndesaulniers@google.com \
--cc=dgilbert@interlog.com \
--cc=gregkh@linuxfoundation.org \
--cc=hare@suse.de \
--cc=hch@lst.de \
--cc=jejb@linux.vnet.ibm.com \
--cc=jthumshirn@suse.de \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=martin.petersen@oracle.com \
--cc=rglasser@google.com \
--cc=salyzyn@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).