Home Home > GIT Browse > openSUSE-15.0
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorHannes Reinecke <hare@suse.de>2017-10-20 15:32:55 +0200
committerTakashi Iwai <tiwai@suse.de>2017-10-20 20:58:48 +0200
commita69df70f25bb9f986a02b8fb7832c815fa58d739 (patch)
treed6ce1d6f6f8049a2ad9641ce3ecac81f41d97766
parent1f6d3538646f5a9172cf83261b0e70b887961373 (diff)
scsi: sg: only check for dxfer_len greater than 256Mrpm-4.4.92-6.18
(bsc#1064206).
-rw-r--r--patches.fixes/scsi-sg-only-check-for-dxfer_len-greater-than-256M.patch43
-rw-r--r--series.conf1
2 files changed, 44 insertions, 0 deletions
diff --git a/patches.fixes/scsi-sg-only-check-for-dxfer_len-greater-than-256M.patch b/patches.fixes/scsi-sg-only-check-for-dxfer_len-greater-than-256M.patch
new file mode 100644
index 0000000000..8c00a0891d
--- /dev/null
+++ b/patches.fixes/scsi-sg-only-check-for-dxfer_len-greater-than-256M.patch
@@ -0,0 +1,43 @@
+From: Johannes Thumshirn <jthumshirn@suse.de>
+Date: Thu, 27 Jul 2017 09:11:26 +0200
+Subject: [PATCH] scsi: sg: only check for dxfer_len greater than 256M
+Git-commit: f930c7043663188429cd9b254e9d761edfc101ce
+Patch-Mainline: v4.12
+References: bsc#1064206
+
+Don't make any assumptions on the sg_io_hdr_t::dxfer_direction or the
+sg_io_hdr_t::dxferp in order to determine if it is a valid request. The
+only way we can check for bad requests is by checking if the length
+exceeds 256M.
+
+Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
+Fixes: 28676d869bbb (scsi: sg: check for valid direction before starting the
+request)
+Reported-by: Jason L Tibbitts III <tibbs@math.uh.edu>
+Tested-by: Jason L Tibbitts III <tibbs@math.uh.edu>
+Suggested-by: Doug Gilbert <dgilbert@interlog.com>
+Cc: Doug Gilbert <dgilbert@interlog.com>
+Cc: <stable@vger.kernel.org>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+---
+ drivers/scsi/sg.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
+index a7c26be..5b83b7f 100644
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -776,6 +776,9 @@ sg_common_write(Sg_fd * sfp, Sg_request * srp,
+ "sg_common_write: scsi opcode=0x%02x, cmd_size=%d\n",
+ (int) cmnd[0], (int) hp->cmd_len));
+
++ if (hp->dxfer_len >= SZ_256M)
++ return -EINVAL;
++
+ k = sg_start_req(srp, cmnd);
+ if (k) {
+ SCSI_LOG_TIMEOUT(1, sg_printk(KERN_INFO, sfp->parentdp,
+--
+1.8.5.6
+
diff --git a/series.conf b/series.conf
index c4d6f28e21..2a0739fc01 100644
--- a/series.conf
+++ b/series.conf
@@ -5939,6 +5939,7 @@
patches.fixes/scsi-fixup-kernel-warning-during-rmmod.patch
patches.fixes/scsi-sg-close-race-condition-in-sg_remove_sfp_userco.patch
patches.fixes/scsi-sg-don-t-return-bogus-Sg_requests.patch
+ patches.fixes/scsi-sg-only-check-for-dxfer_len-greater-than-256M.patch
# ATA update
patches.drivers/ata-0001-ahci-per-port-msix-support.patch