Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1358417
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 4.2.y-ckt 09/98] libata: fix HDIO_GET_32BIT ioctl |
| Date | 2016-03-16 01:00 +0100 |
| Message-ID | <rd72y-M3-17@gated-at.bofh.it> (permalink) |
| References | <rd6Jb-EH-5@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
4.2.8-ckt6 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Arnd Bergmann <arnd@arndb.de>
commit 287e6611ab1eac76c2c5ebf6e345e04c80ca9c61 upstream.
As reported by Soohoon Lee, the HDIO_GET_32BIT ioctl does not
work correctly in compat mode with libata.
I have investigated the issue further and found multiple problems
that all appeared with the same commit that originally introduced
HDIO_GET_32BIT handling in libata back in linux-2.6.8 and presumably
also linux-2.4, as the code uses "copy_to_user(arg, &val, 1)" to copy
a 'long' variable containing either 0 or 1 to user space.
The problems with this are:
* On big-endian machines, this will always write a zero because it
stores the wrong byte into user space.
* In compat mode, the upper three bytes of the variable are updated
by the compat_hdio_ioctl() function, but they now contain
uninitialized stack data.
* The hdparm tool calling this ioctl uses a 'static long' variable
to store the result. This means at least the upper bytes are
initialized to zero, but calling another ioctl like HDIO_GET_MULTCOUNT
would fill them with data that remains stale when the low byte
is overwritten. Fortunately libata doesn't implement any of the
affected ioctl commands, so this would only happen when we query
both an IDE and an ATA device in the same command such as
"hdparm -N -c /dev/hda /dev/sda"
* The libata code for unknown reasons started using ATA_IOC_GET_IO32
and ATA_IOC_SET_IO32 as aliases for HDIO_GET_32BIT and HDIO_SET_32BIT,
while the ioctl commands that were added later use the normal
HDIO_* names. This is harmless but rather confusing.
This addresses all four issues by changing the code to use put_user()
on an 'unsigned long' variable in HDIO_GET_32BIT, like the IDE subsystem
does, and by clarifying the names of the ioctl commands.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reported-by: Soohoon Lee <Soohoon.Lee@f5.com>
Tested-by: Soohoon Lee <Soohoon.Lee@f5.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/ata/libata-scsi.c | 11 +++++------
include/linux/ata.h | 4 ++--
2 files changed, 7 insertions(+), 8 deletions(-)
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 0d7f0da..ae7cfcb 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -675,19 +675,18 @@ static int ata_ioc32(struct ata_port *ap)
int ata_sas_scsi_ioctl(struct ata_port *ap, struct scsi_device *scsidev,
int cmd, void __user *arg)
{
- int val = -EINVAL, rc = -EINVAL;
+ unsigned long val;
+ int rc = -EINVAL;
unsigned long flags;
switch (cmd) {
- case ATA_IOC_GET_IO32:
+ case HDIO_GET_32BIT:
spin_lock_irqsave(ap->lock, flags);
val = ata_ioc32(ap);
spin_unlock_irqrestore(ap->lock, flags);
- if (copy_to_user(arg, &val, 1))
- return -EFAULT;
- return 0;
+ return put_user(val, (unsigned long __user *)arg);
- case ATA_IOC_SET_IO32:
+ case HDIO_SET_32BIT:
val = (unsigned long) arg;
rc = 0;
spin_lock_irqsave(ap->lock, flags);
diff --git a/include/linux/ata.h b/include/linux/ata.h
index d2992bf..c1a2f34 100644
--- a/include/linux/ata.h
+++ b/include/linux/ata.h
@@ -487,8 +487,8 @@ enum ata_tf_protocols {
};
enum ata_ioctls {
- ATA_IOC_GET_IO32 = 0x309,
- ATA_IOC_SET_IO32 = 0x324,
+ ATA_IOC_GET_IO32 = 0x309, /* HDIO_GET_32BIT */
+ ATA_IOC_SET_IO32 = 0x324, /* HDIO_SET_32BIT */
};
/* core structures */
--
2.7.0
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[4.2.y-ckt stable] Linux 4.2.8-ckt6 stable review Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100 [PATCH 4.2.y-ckt 21/98] iommu/amd: Fix boot warning when device 00:00.0 is not iommu covered Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100 [PATCH 4.2.y-ckt 87/98] tcp: fix tcpi_segs_in after connection establishment Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100 [PATCH 4.2.y-ckt 65/98] ovl: fix getcwd() failure after unsuccessful rmdir Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100 [PATCH 4.2.y-ckt 89/98] tcp: convert cached rtt from usec to jiffies when feeding initial rto Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100 [PATCH 4.2.y-ckt 08/98] mac80211: minstrel: Change expected throughput unit back to Kbps Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100 [PATCH 4.2.y-ckt 88/98] be2net: Don't leak iomapped memory on removal. Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100 [PATCH 4.2.y-ckt 83/98] MIPS: Fix build error when SMP is used without GIC Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100 [PATCH 4.2.y-ckt 93/98] ipv6: re-enable fragment header matching in ipv6_find_hdr Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100 [PATCH 4.2.y-ckt 82/98] dmaengine: at_xdmac: fix residue computation Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100 [PATCH 4.2.y-ckt 60/98] drm/radeon/pm: update current crtc info after setting the powerstate Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100 [PATCH 4.2.y-ckt 85/98] dmaengine: pxa_dma: fix cyclic transfers Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100 [PATCH 4.2.y-ckt 37/98] arm/arm64: KVM: Fix ioctl error handling Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100 [PATCH 4.2.y-ckt 94/98] net/mlx5e: Remove wrong poll CQ optimization Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100 [PATCH 4.2.y-ckt 77/98] jffs2: reduce the breakage on recovery from halfway failed rename() Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100 [PATCH 4.2.y-ckt 86/98] MIPS: smp.c: Fix uninitialised temp_foreign_map Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100 [PATCH 4.2.y-ckt 98/98] mld, igmp: Fix reserved tailroom calculation Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100 [PATCH 4.2.y-ckt 63/98] ALSA: hda - Fix mic issues on Acer Aspire E1-472 Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 76/98] ncpfs: fix a braino in OOM handling in ncp_fill_cache() Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 70/98] target: Drop incorrect ABORT_TASK put for completed commands Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 58/98] USB: qcserial: add Sierra Wireless EM74xx device ID Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 50/98] USB: serial: option: add support for Quectel UC20 Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 79/98] arm64: account for sparsemem section alignment when choosing vmemmap offset Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 61/98] drm/amdgpu: return from atombios_dp_get_dpcd only when error Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 80/98] tracing: Fix check for cpu online when event is disabled Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 47/98] ASoC: wm8994: Fix enum ctl accesses in a wrong type Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 44/98] USB: cp210x: Add ID for Parrot NMEA GPS Flight Recorder Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 45/98] ASoC: dapm: Fix ctl value accesses in a wrong type Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 57/98] drm/ast: Fix incorrect register check for DRAM width Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 46/98] ASoC: wm8958: Fix enum ctl accesses in a wrong type Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 49/98] USB: serial: option: add support for Telit LE922 PID 0x1045 Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 59/98] drm/amdgpu/pm: update current crtc info after setting the powerstate Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 48/98] ASoC: wm_adsp: Fix enum ctl accesses in a wrong type Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 42/98] use ->d_seq to get coherency between ->d_inode and ->d_flags Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 54/98] i2c: brcmstb: allocate correct amount of memory for regmap Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 56/98] parisc: Fix ptrace syscall number and return value modification Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 66/98] ovl: ignore lower entries when checking purity of non-directory entries Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 51/98] ALSA: usb-audio: Add a quirk for Plantronics DA45 Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 72/98] ARM: dts: dra7: do not gate cpsw clock due to errata i877 Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 43/98] USB: qcserial: add Dell Wireless 5809e Gobi 4G HSPA+ (rev3) Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 78/98] KVM: VMX: disable PEBS before a guest entry Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 68/98] MIPS: traps: Fix SIGFPE information leak from `do_ov' and `do_trap_or_bp' Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 71/98] ARM: OMAP2+: hwmod: Introduce ti,no-idle dt property Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 62/98] PM / sleep / x86: Fix crash on graph trace through x86 suspend Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 55/98] ALSA: seq: oss: Don't drain at closing a client Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 73/98] PCI: Allow a NULL "parent" pointer in pci_bus_assign_domain_nr() Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 41/98] ALSA: hdsp: Fix wrong boolean ctl value accesses Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 52/98] mac80211: check PN correctly for GCMP-encrypted fragmented MPDUs Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 81/98] KVM: MMU: fix ept=0/pte.u=1/pte.w=0/CR0.WP=0/CR4.SMEP=1/EFER.NX=0 combo Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100 [PATCH 4.2.y-ckt 29/98] ALSA: ctl: Fix ioctls for X32 ABI Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 26/98] KVM: x86: fix root cause for missed hardware breakpoints Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 10/98] iwlwifi: mvm: inc pending frames counter also when txing non-sta Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 35/98] CIFS: Fix SMB2+ interim response processing for read requests Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 16/98] mac80211: minstrel_ht: set default tx aggregation timeout to 0 Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 02/98] tipc: fix nullptr crash during subscription cancel Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 09/98] libata: fix HDIO_GET_32BIT ioctl Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 39/98] ALSA: hdspm: Fix wrong boolean ctl value accesses Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 18/98] Revert "jffs2: Fix lock acquisition order bug in jffs2_write_begin" Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 27/98] arm64: vmemmap: use virtual projection of linear region Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 06/98] cfg80211/wext: fix message ordering Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 34/98] cifs: fix out-of-bounds access in lease parsing Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 40/98] ALSA: hdspm: Fix zero-division Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 22/98] iommu/amd: Apply workaround for ATS write permission check Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 13/98] ahci: Order SATA device IDs for codename Lewisburg Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 04/98] Input: aiptek - fix crash on detecting device without endpoints Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 01/98] tipc: fix connection abort during subscription cancel Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 31/98] ALSA: rawmidi: Fix ioctls X32 ABI Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 14/98] Adding Intel Lewisburg device IDs for SATA Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 05/98] wext: fix message delay/ordering Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 07/98] mac80211: fix use of uninitialised values in RX aggregation Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 11/98] [media] adv7604: fix tx 5v detect regression Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 20/98] Fix directory hardlinks from deleted directories Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 25/98] fbcon: set a default value to blink interval Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 23/98] libata: Align ata_device's id on a cacheline Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 30/98] ALSA: pcm: Fix ioctls for X32 ABI Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 33/98] ALSA: timer: Fix ioctls for X32 ABI Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 38/98] MIPS: kvm: Fix ioctl error handling. Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 28/98] vfio: fix ioctl error handling Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 17/98] usb: chipidea: otg: change workqueue ci_otg as freezable Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 36/98] Fix cifs_uniqueid_to_ino_t() function for s390x Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100 [PATCH 4.2.y-ckt 24/98] can: gs_usb: fixed disconnect bug by removing erroneous use of kfree() Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100
csiph-web