Jann Horn
6e51bfa950
scsi: sg: mitigate read/write abuse
...
commit 26b5b874af upstream.
As Al Viro noted in commit 128394eff3 ("sg_write()/bsg_write() is not fit
to be called under KERNEL_DS"), sg improperly accesses userspace memory
outside the provided buffer, permitting kernel memory corruption via
splice(). But it doesn't just do it on ->write(), also on ->read().
As a band-aid, make sure that the ->read() and ->write() handlers can not
be called in weird contexts (kernel context or credentials different from
file opener), like for ib_safe_file_access().
If someone needs to use these interfaces from different security contexts,
a new interface should be written that goes through the ->ioctl() handler.
I've mostly copypasted ib_safe_file_access() over as sg_safe_file_access()
because I couldn't find a good common header - please tell me if you know a
better way.
[mkp: s/_safe_/_check_/]
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Cc: <stable@vger.kernel.org >
Signed-off-by: Jann Horn <jannh@google.com >
Acked-by: Douglas Gilbert <dgilbert@interlog.com >
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com >
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org >
2018-07-11 16:29:14 +02:00
..
2018-05-25 16:17:50 +02:00
2017-11-02 11:10:55 +01:00
2017-08-25 17:21:10 -04:00
2017-08-10 19:40:50 -04:00
2018-04-26 11:02:10 +02:00
2017-08-07 14:04:01 -04:00
2018-02-25 11:08:01 +01:00
2018-05-25 16:17:46 +02:00
2017-07-26 21:51:25 -04:00
2017-11-02 11:10:55 +01:00
2017-12-25 14:26:25 +01:00
2018-02-16 20:23:12 +01:00
2017-06-26 12:44:35 -04:00
2017-06-20 12:18:27 +02:00
2017-08-24 22:28:52 -04:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-12-20 10:10:32 +01:00
2018-02-28 10:19:38 +01:00
2017-11-02 11:10:55 +01:00
2018-06-21 04:02:46 +09:00
2017-11-02 11:10:55 +01:00
2018-05-25 16:17:34 +02:00
2018-05-25 16:17:51 +02:00
2018-06-21 04:02:43 +09:00
2018-05-25 16:17:49 +02:00
2018-05-25 16:17:50 +02:00
2018-01-02 20:31:05 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-09-07 12:12:43 -07:00
2018-05-25 16:17:49 +02:00
2018-07-03 11:24:57 +02:00
2018-05-25 16:17:48 +02:00
2018-02-22 15:42:14 +01:00
2017-11-02 11:10:55 +01:00
2018-05-25 16:17:47 +02:00
2018-05-25 16:17:46 +02:00
2016-12-24 11:46:01 -08:00
2016-12-14 15:25:12 -05:00
2016-12-24 11:46:01 -08:00
2016-12-14 15:25:12 -05:00
2016-12-24 11:46:01 -08:00
2016-12-14 15:25:12 -05:00
2017-08-25 17:21:11 -04:00
2017-11-02 11:10:55 +01:00
2017-08-25 17:21:10 -04:00
2017-11-02 11:10:55 +01:00
2017-08-25 17:21:10 -04:00
2017-11-02 11:10:55 +01:00
2017-04-04 19:39:39 -04:00
2017-08-25 17:21:11 -04:00
2017-11-02 11:10:55 +01:00
2017-08-24 22:29:07 -04:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-08-25 17:21:11 -04:00
2017-11-02 11:10:55 +01:00
2017-04-21 10:31:33 -04:00
2017-04-21 10:31:33 -04:00
2017-08-24 22:29:06 -04:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-08-25 17:21:11 -04:00
2017-08-10 19:55:35 -04:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-08-25 17:21:12 -04:00
2017-08-10 19:55:35 -04:00
2017-11-02 11:10:55 +01:00
2017-08-25 17:21:10 -04:00
2017-08-25 17:21:10 -04:00
2017-08-25 17:21:11 -04:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-08-07 14:04:01 -04:00
2017-11-02 11:10:55 +01:00
2017-08-25 17:21:10 -04:00
2017-11-02 11:10:55 +01:00
2018-03-15 10:54:29 +01:00
2017-06-12 20:48:00 -04:00
2018-07-03 11:24:57 +02:00
2017-08-24 22:28:55 -04:00
2017-08-25 17:21:10 -04:00
2017-08-25 17:21:11 -04:00
2017-11-02 11:10:55 +01:00
2017-08-22 22:23:36 -04:00
2017-08-08 11:49:51 -04:00
2017-06-20 12:18:27 +02:00
2017-06-20 12:18:27 +02:00
2018-05-25 16:17:49 +02:00
2017-09-13 10:47:14 -07:00
2017-08-22 16:34:36 +02:00
2018-04-12 12:32:14 +02:00
2017-08-07 14:04:02 -04:00
2017-11-02 11:10:55 +01:00
2017-08-10 19:55:34 -04:00
2017-08-25 17:21:11 -04:00
2017-11-02 11:10:55 +01:00
2017-08-07 14:04:01 -04:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-04-24 18:16:49 -04:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-09-01 11:59:17 +02:00
2017-11-02 11:10:55 +01:00
2017-08-25 17:21:11 -04:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-08-24 22:29:01 -04:00
2017-11-02 11:10:55 +01:00
2017-08-24 22:29:05 -04:00
2017-08-07 14:04:01 -04:00
2017-08-25 17:21:11 -04:00
2017-11-02 11:10:55 +01:00
2017-05-16 08:44:21 -03:00
2017-08-25 17:21:11 -04:00
2017-11-02 11:10:55 +01:00
2017-08-25 17:21:11 -04:00
2017-08-28 22:15:46 -04:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-12-20 10:10:28 +01:00
2017-12-20 10:10:20 +01:00
2017-04-26 15:09:04 -06:00
2018-04-26 11:02:10 +02:00
2018-03-19 08:42:53 +01:00
2018-03-15 10:54:29 +01:00
2017-08-25 17:08:07 -04:00
2017-11-02 11:10:55 +01:00
2018-05-25 16:17:50 +02:00
2017-11-02 11:10:55 +01:00
2017-04-13 13:58:20 -04:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2018-02-22 15:42:31 +01:00
2017-11-02 11:10:55 +01:00
2017-10-11 14:33:12 -04:00
2018-06-21 04:02:43 +09:00
2017-08-29 21:51:45 -04:00
2017-02-23 16:57:19 -05:00
2018-06-05 11:41:59 +02:00
2017-09-07 12:12:43 -07:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2018-06-11 22:49:17 +02:00
2018-05-25 16:17:49 +02:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2018-03-19 08:42:51 +01:00
2018-07-11 16:29:14 +02:00
2017-08-25 17:21:10 -04:00
2017-03-15 19:27:46 -04:00
2018-05-30 07:51:49 +02:00
2017-11-02 11:10:55 +01:00
2018-05-30 07:52:34 +02:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-08-08 11:49:51 -04:00
2017-11-02 11:10:55 +01:00
2017-04-26 18:32:29 -04:00
2018-06-21 04:02:46 +09:00
2017-08-25 17:21:11 -04:00
2017-06-27 21:46:55 -04:00
2017-08-24 22:28:51 -04:00
2018-06-21 04:02:52 +09:00
2017-01-11 22:31:03 -05:00
2017-08-25 17:21:10 -04:00
2017-11-02 11:10:55 +01:00
2017-06-12 21:02:04 -04:00
2017-08-22 16:34:36 +02:00