Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1359334

[PATCH 3.19.y-ckt 06/70] libata: fix HDIO_GET_32BIT ioctl

From Kamal Mostafa <kamal@canonical.com>
Newsgroups linux.kernel
Subject [PATCH 3.19.y-ckt 06/70] libata: fix HDIO_GET_32BIT ioctl
Date 2016-03-16 21:30 +0100
Message-ID <rdqeT-5tf-45@gated-at.bofh.it> (permalink)
References <rdpVv-5jX-3@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

v3.19.8-ckt17 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Arnd Bergmann <arnd@arndb.de>

commit 287e6611ab1eac76c2c5ebf6e345e04c80ca9c61 upstream.

As reported by Soohoon Lee, the HDIO_GET_32BIT ioctl does not
work correctly in compat mode with libata.

I have investigated the issue further and found multiple problems
that all appeared with the same commit that originally introduced
HDIO_GET_32BIT handling in libata back in linux-2.6.8 and presumably
also linux-2.4, as the code uses "copy_to_user(arg, &val, 1)" to copy
a 'long' variable containing either 0 or 1 to user space.

The problems with this are:

* On big-endian machines, this will always write a zero because it
  stores the wrong byte into user space.

* In compat mode, the upper three bytes of the variable are updated
  by the compat_hdio_ioctl() function, but they now contain
  uninitialized stack data.

* The hdparm tool calling this ioctl uses a 'static long' variable
  to store the result. This means at least the upper bytes are
  initialized to zero, but calling another ioctl like HDIO_GET_MULTCOUNT
  would fill them with data that remains stale when the low byte
  is overwritten. Fortunately libata doesn't implement any of the
  affected ioctl commands, so this would only happen when we query
  both an IDE and an ATA device in the same command such as
  "hdparm -N -c /dev/hda /dev/sda"

* The libata code for unknown reasons started using ATA_IOC_GET_IO32
  and ATA_IOC_SET_IO32 as aliases for HDIO_GET_32BIT and HDIO_SET_32BIT,
  while the ioctl commands that were added later use the normal
  HDIO_* names. This is harmless but rather confusing.

This addresses all four issues by changing the code to use put_user()
on an 'unsigned long' variable in HDIO_GET_32BIT, like the IDE subsystem
does, and by clarifying the names of the ioctl commands.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reported-by: Soohoon Lee <Soohoon.Lee@f5.com>
Tested-by: Soohoon Lee <Soohoon.Lee@f5.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/ata/libata-scsi.c | 11 +++++------
 include/linux/ata.h       |  4 ++--
 2 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index d13d49f..15a1223 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -675,19 +675,18 @@ static int ata_ioc32(struct ata_port *ap)
 int ata_sas_scsi_ioctl(struct ata_port *ap, struct scsi_device *scsidev,
 		     int cmd, void __user *arg)
 {
-	int val = -EINVAL, rc = -EINVAL;
+	unsigned long val;
+	int rc = -EINVAL;
 	unsigned long flags;
 
 	switch (cmd) {
-	case ATA_IOC_GET_IO32:
+	case HDIO_GET_32BIT:
 		spin_lock_irqsave(ap->lock, flags);
 		val = ata_ioc32(ap);
 		spin_unlock_irqrestore(ap->lock, flags);
-		if (copy_to_user(arg, &val, 1))
-			return -EFAULT;
-		return 0;
+		return put_user(val, (unsigned long __user *)arg);
 
-	case ATA_IOC_SET_IO32:
+	case HDIO_SET_32BIT:
 		val = (unsigned long) arg;
 		rc = 0;
 		spin_lock_irqsave(ap->lock, flags);
diff --git a/include/linux/ata.h b/include/linux/ata.h
index 3c35318..c5c6b5a 100644
--- a/include/linux/ata.h
+++ b/include/linux/ata.h
@@ -485,8 +485,8 @@ enum ata_tf_protocols {
 };
 
 enum ata_ioctls {
-	ATA_IOC_GET_IO32	= 0x309,
-	ATA_IOC_SET_IO32	= 0x324,
+	ATA_IOC_GET_IO32	= 0x309, /* HDIO_GET_32BIT */
+	ATA_IOC_SET_IO32	= 0x324, /* HDIO_SET_32BIT */
 };
 
 /* core structures */
-- 
2.7.0

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[3.19.y-ckt stable] Linux v3.19.8-ckt17 stable review Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:10 +0100
  [PATCH 3.19.y-ckt 03/70] wext: fix message delay/ordering Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:10 +0100
  [PATCH 3.19.y-ckt 58/70] tracing: Fix check for cpu online when event is disabled Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:10 +0100
  [PATCH 3.19.y-ckt 53/70] ARM: dts: dra7: do not gate cpsw clock due to errata i877 Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:10 +0100
  [PATCH 3.19.y-ckt 09/70] ahci: add new Intel device IDs Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:10 +0100
  [PATCH 3.19.y-ckt 47/70] ovl: fix getcwd() failure after unsuccessful rmdir Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:10 +0100
  [PATCH 3.19.y-ckt 54/70] Revert "drm/radeon: call hpd_irq_event on resume" Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:10 +0100
  [PATCH 3.19.y-ckt 16/70] Fix directory hardlinks from deleted directories Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:10 +0100
  [PATCH 3.19.y-ckt 44/70] drm/radeon/pm: update current crtc info after setting the powerstate Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:10 +0100
  [PATCH 3.19.y-ckt 23/70] ALSA: rawmidi: Fix ioctls X32 ABI Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:10 +0100
  [PATCH 3.19.y-ckt 69/70] mld, igmp: Fix reserved tailroom calculation Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:10 +0100
  [PATCH 3.19.y-ckt 61/70] gpio: rcar: Add Runtime PM handling for interrupts Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:20 +0100
  [PATCH 3.19.y-ckt 56/70] jffs2: reduce the breakage on recovery from halfway failed rename() Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:20 +0100
  [PATCH 3.19.y-ckt 65/70] ipv6: re-enable fragment header matching in ipv6_find_hdr Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:20 +0100
  [PATCH 3.19.y-ckt 66/70] cdc_ncm: do not call usbnet_link_change from cdc_ncm_bind Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:20 +0100
  [PATCH 3.19.y-ckt 51/70] target: Drop incorrect ABORT_TASK put for completed commands Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:20 +0100
  [PATCH 3.19.y-ckt 55/70] KVM: PPC: Book3S HV: Sanitize special-purpose register values on guest exit Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:20 +0100
  [PATCH 3.19.y-ckt 46/70] ALSA: hda - Fix mic issues on Acer Aspire E1-472 Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:20 +0100
  [PATCH 3.19.y-ckt 29/70] arm/arm64: KVM: Fix ioctl error handling Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:20 +0100
  [PATCH 3.19.y-ckt 52/70] ARM: OMAP2+: hwmod: Introduce ti,no-idle dt property Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:20 +0100
  [PATCH 3.19.y-ckt 34/70] USB: cp210x: Add ID for Parrot NMEA GPS Flight Recorder Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:20 +0100
  [PATCH 3.19.y-ckt 24/70] ALSA: timer: Fix broken compat timer user status ioctl Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:20 +0100
  [PATCH 3.19.y-ckt 57/70] KVM: VMX: disable PEBS before a guest entry Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:20 +0100
  [PATCH 3.19.y-ckt 50/70] ubi: Fix out of bounds write in volume update code Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:20 +0100
  [PATCH 3.19.y-ckt 67/70] net: qca_spi: Don't clear IFF_BROADCAST Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:20 +0100
  [PATCH 3.19.y-ckt 43/70] USB: qcserial: add Sierra Wireless EM74xx device ID Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:20 +0100
  [PATCH 3.19.y-ckt 45/70] PM / sleep / x86: Fix crash on graph trace through x86 suspend Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:20 +0100
  [PATCH 3.19.y-ckt 39/70] USB: serial: option: add support for Quectel UC20 Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:20 +0100
  [PATCH 3.19.y-ckt 62/70] tcp: convert cached rtt from usec to jiffies when feeding initial rto Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:20 +0100
  [PATCH 3.19.y-ckt 64/70] net/mlx4_core: Allow resetting VF admin mac to zero Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:20 +0100
  [PATCH 3.19.y-ckt 59/70] KVM: MMU: fix ept=0/pte.u=1/pte.w=0/CR0.WP=0/CR4.SMEP=1/EFER.NX=0 combo Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:20 +0100
  [PATCH 3.19.y-ckt 63/70] ext4: iterate over buffer heads correctly in move_extent_per_page() Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:20 +0100
  [PATCH 3.19.y-ckt 49/70] MIPS: traps: Fix SIGFPE information leak from `do_ov' and `do_trap_or_bp' Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:20 +0100
  [PATCH 3.19.y-ckt 42/70] drm/ast: Fix incorrect register check for DRAM width Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:20 +0100
  [PATCH 3.19.y-ckt 40/70] mac80211: Fix Public Action frame RX in AP mode Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:20 +0100
  [PATCH 3.19.y-ckt 41/70] ALSA: seq: oss: Don't drain at closing a client Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:20 +0100
  [PATCH 3.19.y-ckt 32/70] ALSA: hdsp: Fix wrong boolean ctl value accesses Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:20 +0100
  [PATCH 3.19.y-ckt 60/70] MIPS: Fix build error when SMP is used without GIC Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:20 +0100
  [PATCH 3.19.y-ckt 38/70] USB: serial: option: add support for Telit LE922 PID 0x1045 Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:20 +0100
  [PATCH 3.19.y-ckt 48/70] ovl: copy new uid/gid into overlayfs runtime inode Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:20 +0100
  [PATCH 3.19.y-ckt 04/70] cfg80211/wext: fix message ordering Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:30 +0100
  [PATCH 3.19.y-ckt 11/70] Adding Intel Lewisburg device IDs for SATA Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:30 +0100
  [PATCH 3.19.y-ckt 30/70] ALSA: hdspm: Fix wrong boolean ctl value accesses Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:30 +0100
  [PATCH 3.19.y-ckt 15/70] jffs2: Fix page lock / f->sem deadlock Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:30 +0100
  [PATCH 3.19.y-ckt 05/70] mac80211: fix use of uninitialised values in RX aggregation Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:30 +0100
  [PATCH 3.19.y-ckt 18/70] iommu/amd: Apply workaround for ATS write permission check Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:30 +0100
  [PATCH 3.19.y-ckt 28/70] Fix cifs_uniqueid_to_ino_t() function for s390x Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:30 +0100
  [PATCH 3.19.y-ckt 10/70] ahci: Order SATA device IDs for codename Lewisburg Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:30 +0100
  [PATCH 3.19.y-ckt 33/70] USB: qcserial: add Dell Wireless 5809e Gobi 4G HSPA+ (rev3) Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:30 +0100
  [PATCH 3.19.y-ckt 37/70] ASoC: wm_adsp: Fix enum ctl accesses in a wrong type Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:30 +0100
  [PATCH 3.19.y-ckt 26/70] cifs: fix out-of-bounds access in lease parsing Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:30 +0100
  [PATCH 3.19.y-ckt 22/70] ALSA: ctl: Fix ioctls for X32 ABI Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:30 +0100
  [PATCH 3.19.y-ckt 02/70] Input: aiptek - fix crash on detecting device without endpoints Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:30 +0100
  [PATCH 3.19.y-ckt 06/70] libata: fix HDIO_GET_32BIT ioctl Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:30 +0100
  [PATCH 3.19.y-ckt 20/70] can: gs_usb: fixed disconnect bug by removing erroneous use of kfree() Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:30 +0100
  [PATCH 3.19.y-ckt 25/70] ALSA: timer: Fix ioctls for X32 ABI Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:30 +0100
  [PATCH 3.19.y-ckt 31/70] ALSA: hdspm: Fix zero-division Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:30 +0100
  [PATCH 3.19.y-ckt 14/70] Revert "jffs2: Fix lock acquisition order bug in jffs2_write_begin" Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:30 +0100
  [PATCH 3.19.y-ckt 27/70] CIFS: Fix SMB2+ interim response processing for read requests Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:30 +0100
  [PATCH 3.19.y-ckt 36/70] ASoC: wm8994: Fix enum ctl accesses in a wrong type Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:30 +0100
  [PATCH 3.19.y-ckt 12/70] mac80211: minstrel_ht: set default tx aggregation timeout to 0 Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:30 +0100
  [PATCH 3.19.y-ckt 17/70] iommu/amd: Fix boot warning when device 00:00.0 is not iommu covered Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:30 +0100
  [PATCH 3.19.y-ckt 21/70] vfio: fix ioctl error handling Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:30 +0100
  [PATCH 3.19.y-ckt 13/70] usb: chipidea: otg: change workqueue ci_otg as freezable Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:30 +0100
  [PATCH 3.19.y-ckt 35/70] ASoC: wm8958: Fix enum ctl accesses in a wrong type Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:30 +0100
  [PATCH 3.19.y-ckt 07/70] iwlwifi: mvm: inc pending frames counter also when txing non-sta Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:30 +0100
  [PATCH 3.19.y-ckt 19/70] libata: Align ata_device's id on a cacheline Kamal Mostafa <kamal@canonical.com> - 2016-03-16 21:30 +0100

csiph-web