diff options
| author | Christoph Hellwig <hch@lst.de> | 2017-04-25 14:39:54 +0300 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2017-08-26 04:14:03 +0300 |
| commit | 4d34a500e77add127cdee5b4778079596a9ebabe (patch) | |
| tree | b4fd6566537e68603ac882a58c5b1da6b76f54e2 | |
| parent | 258132a3ab98637570e7961fe29cdcad408a7912 (diff) | |
| download | linux-4d34a500e77add127cdee5b4778079596a9ebabe.tar.xz | |
libata: reject passthrough WRITE SAME requests
commit c6ade20f5e50e188d20b711a618b20dd1d50457e upstream.
The WRITE SAME to TRIM translation rewrites the DATA OUT buffer. While
the SCSI code accomodates for this by passing a read-writable buffer
userspace applications don't cater for this behavior. In fact it can
be used to rewrite e.g. a readonly file through mmap and should be
considered as a security fix.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
[bwh: Backported to 3.2:
- Open-code blk_rq_is_passthrough()
- We don't distinguish which field is invaid so goto invalid_fld
- Adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
| -rw-r--r-- | drivers/ata/libata-scsi.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c index eeadf8f9903f..01a019eaf30a 100644 --- a/drivers/ata/libata-scsi.c +++ b/drivers/ata/libata-scsi.c @@ -3056,6 +3056,14 @@ static unsigned int ata_scsi_write_same_xlat(struct ata_queued_cmd *qc) if (unlikely(!dev->dma_mode)) goto invalid_fld; + /* + * We only allow sending this command through the block layer, + * as it modifies the DATA OUT buffer, which would corrupt user + * memory for SG_IO commands. + */ + if (unlikely(scmd->request->cmd_type != REQ_TYPE_FS)) + goto invalid_fld; + if (unlikely(scmd->cmd_len < 16)) goto invalid_fld; scsi_16_lba_len(cdb, &block, &n_block); |