Files
linux/drivers/scsi
Jann Horn 6e51bfa950 scsi: sg: mitigate read/write abuse
commit 26b5b874af upstream.

As Al Viro noted in commit 128394eff3 ("sg_write()/bsg_write() is not fit
to be called under KERNEL_DS"), sg improperly accesses userspace memory
outside the provided buffer, permitting kernel memory corruption via
splice().  But it doesn't just do it on ->write(), also on ->read().

As a band-aid, make sure that the ->read() and ->write() handlers can not
be called in weird contexts (kernel context or credentials different from
file opener), like for ib_safe_file_access().

If someone needs to use these interfaces from different security contexts,
a new interface should be written that goes through the ->ioctl() handler.

I've mostly copypasted ib_safe_file_access() over as sg_safe_file_access()
because I couldn't find a good common header - please tell me if you know a
better way.

[mkp: s/_safe_/_check_/]

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Cc: <stable@vger.kernel.org>
Signed-off-by: Jann Horn <jannh@google.com>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-11 16:29:14 +02:00
..
2017-12-25 14:26:25 +01:00
2018-01-02 20:31:05 +01:00
2017-09-07 12:12:43 -07:00
2017-08-25 17:21:11 -04:00
2017-08-24 22:29:06 -04:00
2017-08-25 17:21:10 -04:00
2017-08-08 11:49:51 -04:00
2017-08-25 17:21:11 -04:00
2018-03-19 08:42:53 +01:00
2017-04-13 13:58:20 -04:00
2017-09-07 12:12:43 -07:00
2018-07-11 16:29:14 +02:00
2017-08-08 11:49:51 -04:00
2017-04-26 18:32:29 -04:00