1. 04 2月, 2022 1 次提交
  2. 05 1月, 2022 1 次提交
  3. 29 11月, 2021 3 次提交
  4. 09 11月, 2021 2 次提交
  5. 05 11月, 2021 1 次提交
    • T
      scsi: core: Remove command size deduction from scsi_setup_scsi_cmnd() · 703535e6
      Tadeusz Struk 提交于
      No need to deduce command size in scsi_setup_scsi_cmnd() anymore as
      appropriate checks have been added to scsi_fill_sghdr_rq() function and the
      cmd_len should never be zero here.  The code to do that wasn't correct
      anyway, as it used uninitialized cmd->cmnd, which caused a null-ptr-deref
      if the command size was zero as in the trace below. Fix this by removing
      the unneeded code.
      
      KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
      CPU: 0 PID: 1822 Comm: repro Not tainted 5.15.0 #1
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-4.fc34 04/01/2014
      Call Trace:
       blk_mq_dispatch_rq_list+0x7c7/0x12d0
       __blk_mq_sched_dispatch_requests+0x244/0x380
       blk_mq_sched_dispatch_requests+0xf0/0x160
       __blk_mq_run_hw_queue+0xe8/0x160
       __blk_mq_delay_run_hw_queue+0x252/0x5d0
       blk_mq_run_hw_queue+0x1dd/0x3b0
       blk_mq_sched_insert_request+0x1ff/0x3e0
       blk_execute_rq_nowait+0x173/0x1e0
       blk_execute_rq+0x15c/0x540
       sg_io+0x97c/0x1370
       scsi_ioctl+0xe16/0x28e0
       sd_ioctl+0x134/0x170
       blkdev_ioctl+0x362/0x6e0
       block_ioctl+0xb0/0xf0
       vfs_ioctl+0xa7/0xf0
       do_syscall_64+0x3d/0xb0
       entry_SYSCALL_64_after_hwframe+0x44/0xae
      ---[ end trace 8b086e334adef6d2 ]---
      Kernel panic - not syncing: Fatal exception
      
      Link: https://lore.kernel.org/r/20211103170659.22151-2-tadeusz.struk@linaro.org
      Fixes: 2ceda20f ("scsi: core: Move command size detection out of the fast path")
      Cc: Bart Van Assche <bvanassche@acm.org>
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: James E.J. Bottomley <jejb@linux.ibm.com>
      Cc: Martin K. Petersen <martin.petersen@oracle.com>
      Cc: <linux-scsi@vger.kernel.org>
      Cc: <linux-kernel@vger.kernel.org>
      Cc: <stable@vger.kernel.org> # 5.15, 5.14, 5.10
      Reported-by: syzbot+5516b30f5401d4dcbcae@syzkaller.appspotmail.com
      Reviewed-by: NBart Van Assche <bvanassche@acm.org>
      Reviewed-by: NChristoph Hellwig <hch@lst.de>
      Signed-off-by: NTadeusz Struk <tadeusz.struk@linaro.org>
      Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
      703535e6
  6. 04 11月, 2021 1 次提交
  7. 29 10月, 2021 1 次提交
  8. 22 10月, 2021 2 次提交
  9. 19 10月, 2021 1 次提交
  10. 18 10月, 2021 1 次提交
  11. 17 10月, 2021 3 次提交
  12. 05 10月, 2021 1 次提交
  13. 29 9月, 2021 2 次提交
    • D
      scsi: core: Fix scsi_mode_select() buffer length handling · a7d6840b
      Damien Le Moal 提交于
      The MODE SELECT(6) command allows handling mode page buffers that are up to
      255 bytes, including the 4 byte header needed in front of the page
      buffer. For requests larger than this limit, automatically use the MODE
      SELECT(10) command.
      
      In both cases, since scsi_mode_select() adds the mode select page header,
      checks on the buffer length value must include this header size to avoid
      overflows of the command CDB allocation length field.
      
      While at it, use put_unaligned_be16() for setting the header block
      descriptor length and CDB allocation length when using MODE SELECT(10).
      
      [mkp: fix MODE SENSE vs. MODE SELECT confusion]
      
      Link: https://lore.kernel.org/r/20210820070255.682775-3-damien.lemoal@wdc.comSigned-off-by: NDamien Le Moal <damien.lemoal@wdc.com>
      Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
      a7d6840b
    • D
      scsi: core: Fix scsi_mode_sense() buffer length handling · 17b49bcb
      Damien Le Moal 提交于
      Several problems exist with scsi_mode_sense() buffer length handling:
      
       1) The allocation length field of the MODE SENSE(10) command is 16-bits,
          occupying bytes 7 and 8 of the CDB. With this command, access to mode
          pages larger than 255 bytes is thus possible. However, the CDB
          allocation length field is set by assigning len to byte 8 only, thus
          truncating buffer length larger than 255.
      
       2) If scsi_mode_sense() is called with len smaller than 8 with
          sdev->use_10_for_ms set, or smaller than 4 otherwise, the buffer length
          is increased to 8 and 4 respectively, and the buffer is zero filled
          with these increased values, thus corrupting the memory following the
          buffer.
      
      Fix these 2 problems by using put_unaligned_be16() to set the allocation
      length field of MODE SENSE(10) CDB and by returning an error when len is
      too small.
      
      Furthermore, if len is larger than 255B, always try MODE SENSE(10) first,
      even if the device driver did not set sdev->use_10_for_ms. In case of
      invalid opcode error for MODE SENSE(10), access to mode pages larger than
      255 bytes are not retried using MODE SENSE(6). To avoid buffer length
      overflows for the MODE_SENSE(10) case, check that len is smaller than 65535
      bytes.
      
      While at it, also fix the folowing:
      
       * Use get_unaligned_be16() to retrieve the mode data length and block
         descriptor length fields of the mode sense reply header instead of using
         an open coded calculation.
      
       * Fix the kdoc dbd argument explanation: the DBD bit stands for Disable
         Block Descriptor, which is the opposite of what the dbd argument
         description was.
      
      Link: https://lore.kernel.org/r/20210820070255.682775-2-damien.lemoal@wdc.comSigned-off-by: NDamien Le Moal <damien.lemoal@wdc.com>
      Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
      17b49bcb
  14. 18 8月, 2021 1 次提交
  15. 12 8月, 2021 2 次提交
  16. 29 7月, 2021 1 次提交
  17. 13 7月, 2021 1 次提交
  18. 01 7月, 2021 1 次提交
  19. 30 6月, 2021 1 次提交
  20. 23 6月, 2021 1 次提交
  21. 01 6月, 2021 8 次提交
  22. 16 4月, 2021 3 次提交
  23. 06 4月, 2021 1 次提交