Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1347723

[PATCH 3.10 29/80] megaraid_sas : SMAP restriction--do not access user memory from IOCTL code

Show all headers | View raw

3.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: sumit.saxena@avagotech.com <sumit.saxena@avagotech.com>

commit 323c4a02c631d00851d8edc4213c4d184ef83647 upstream.

This is an issue on SMAP enabled CPUs and 32 bit apps running on 64 bit
OS. Do not access user memory from kernel code. The SMAP bit restricts
accessing user memory from kernel code.

Signed-off-by: Sumit Saxena <sumit.saxena@avagotech.com>
Signed-off-by: Kashyap Desai <kashyap.desai@avagotech.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/scsi/megaraid/megaraid_sas_base.c |   13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -5051,6 +5051,9 @@ static int megasas_mgmt_compat_ioctl_fw(
 	int i;
 	int error = 0;
 	compat_uptr_t ptr;
+	unsigned long local_raw_ptr;
+	u32 local_sense_off;
+	u32 local_sense_len;
 
 	if (clear_user(ioc, sizeof(*ioc)))
 		return -EFAULT;
@@ -5068,9 +5071,15 @@ static int megasas_mgmt_compat_ioctl_fw(
 	 * sense_len is not null, so prepare the 64bit value under
 	 * the same condition.
 	 */
-	if (ioc->sense_len) {
+	if (get_user(local_raw_ptr, ioc->frame.raw) ||
+		get_user(local_sense_off, &ioc->sense_off) ||
+		get_user(local_sense_len, &ioc->sense_len))
+		return -EFAULT;
+
+
+	if (local_sense_len) {
 		void __user **sense_ioc_ptr =
-			(void __user **)(ioc->frame.raw + ioc->sense_off);
+			(void __user **)((u8*)local_raw_ptr + local_sense_off);
 		compat_uptr_t *sense_cioc_ptr =
 			(compat_uptr_t *)(cioc->frame.raw + cioc->sense_off);
 		if (get_user(ptr, sense_cioc_ptr) ||

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.10 00/80] 3.10.99-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 08/80] dm thin metadata: fix bug when taking a metadata snapshot Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 02/80] drm/ast: Initialized data needed to map fbdev memory Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 23/80] dts: vt8500: Add SDHC node to DTS file for WM8650 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 07/80] efi: Disable interrupts around EFI calls, not in the epilog/prolog calls Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 31/80] mac: validate mac_partition is within sector Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 14/80] proc: Fix ptrace-based permission checks for accessing task maps Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 29/80] megaraid_sas : SMAP restriction--do not access user memory from IOCTL code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 32/80] ARC: dw2 unwind: Remove falllback linear search thru FDE entries Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 11/80] USB: cp210x: add IDs for GE B650V3 and B850V3 boards Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 41/80] dm btree: fix bufio buffer leaks in dm_btree_del() error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 27/80] wm831x_power: Use IRQF_ONESHOT to request threaded IRQs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 10/80] can: ems_usb: Fix possible tx overflow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 01/80] tracepoints: Do not trace when cpu is offline Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 06/80] drm/radeon: fix hotplug race at startup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 26/80] devres: fix a for loop bounds check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 30/80] mmc: remove bondage between REQ_META and reliable write Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 15/80] iw_cxgb3: Fix incorrectly returning error on success Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 35/80] virtio: fix memory leak of virtio ida cache layers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 04/80] bcache: unregister reboot notifier if bcache fails to unregister device Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:50 +0100
  Re: [PATCH 3.10 00/80] 3.10.99-stable review Guenter Roeck <linux@roeck-us.net> - 2016-03-02 15:40 +0100
    Re: [PATCH 3.10 00/80] 3.10.99-stable review Willy Tarreau <w@1wt.eu> - 2016-03-02 16:50 +0100
      Re: [PATCH 3.10 00/80] 3.10.99-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 18:30 +0100

csiph-web