[PATCH 3.13.y-ckt 06/43] libata: fix HDIO_GET_32BIT ioctl

From	Kamal Mostafa <kamal@canonical.com>
Newsgroups	linux.kernel
Subject	[PATCH 3.13.y-ckt 06/43] libata: fix HDIO_GET_32BIT ioctl
Date	2016-03-22 22:20 +0100
Message-ID	<rfBSz-1PB-41@gated-at.bofh.it> (permalink)
References	<rfBIR-1Lk-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

3.13.11-ckt37 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Arnd Bergmann <arnd@arndb.de>

commit 287e6611ab1eac76c2c5ebf6e345e04c80ca9c61 upstream.

As reported by Soohoon Lee, the HDIO_GET_32BIT ioctl does not
work correctly in compat mode with libata.

I have investigated the issue further and found multiple problems
that all appeared with the same commit that originally introduced
HDIO_GET_32BIT handling in libata back in linux-2.6.8 and presumably
also linux-2.4, as the code uses "copy_to_user(arg, &val, 1)" to copy
a 'long' variable containing either 0 or 1 to user space.

The problems with this are:

* On big-endian machines, this will always write a zero because it
  stores the wrong byte into user space.

* In compat mode, the upper three bytes of the variable are updated
  by the compat_hdio_ioctl() function, but they now contain
  uninitialized stack data.

* The hdparm tool calling this ioctl uses a 'static long' variable
  to store the result. This means at least the upper bytes are
  initialized to zero, but calling another ioctl like HDIO_GET_MULTCOUNT
  would fill them with data that remains stale when the low byte
  is overwritten. Fortunately libata doesn't implement any of the
  affected ioctl commands, so this would only happen when we query
  both an IDE and an ATA device in the same command such as
  "hdparm -N -c /dev/hda /dev/sda"

* The libata code for unknown reasons started using ATA_IOC_GET_IO32
  and ATA_IOC_SET_IO32 as aliases for HDIO_GET_32BIT and HDIO_SET_32BIT,
  while the ioctl commands that were added later use the normal
  HDIO_* names. This is harmless but rather confusing.

This addresses all four issues by changing the code to use put_user()
on an 'unsigned long' variable in HDIO_GET_32BIT, like the IDE subsystem
does, and by clarifying the names of the ioctl commands.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reported-by: Soohoon Lee <Soohoon.Lee@f5.com>
Tested-by: Soohoon Lee <Soohoon.Lee@f5.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/ata/libata-scsi.c | 11 +++++------
 include/linux/ata.h       |  4 ++--
 2 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 6fecf0b..1e82d2a 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -674,19 +674,18 @@ static int ata_ioc32(struct ata_port *ap)
 int ata_sas_scsi_ioctl(struct ata_port *ap, struct scsi_device *scsidev,
 		     int cmd, void __user *arg)
 {
-	int val = -EINVAL, rc = -EINVAL;
+	unsigned long val;
+	int rc = -EINVAL;
 	unsigned long flags;
 
 	switch (cmd) {
-	case ATA_IOC_GET_IO32:
+	case HDIO_GET_32BIT:
 		spin_lock_irqsave(ap->lock, flags);
 		val = ata_ioc32(ap);
 		spin_unlock_irqrestore(ap->lock, flags);
-		if (copy_to_user(arg, &val, 1))
-			return -EFAULT;
-		return 0;
+		return put_user(val, (unsigned long __user *)arg);
 
-	case ATA_IOC_SET_IO32:
+	case HDIO_SET_32BIT:
 		val = (unsigned long) arg;
 		rc = 0;
 		spin_lock_irqsave(ap->lock, flags);
diff --git a/include/linux/ata.h b/include/linux/ata.h
index f2f4d8d..f7ff655 100644
--- a/include/linux/ata.h
+++ b/include/linux/ata.h
@@ -484,8 +484,8 @@ enum ata_tf_protocols {
 };
 
 enum ata_ioctls {
-	ATA_IOC_GET_IO32	= 0x309,
-	ATA_IOC_SET_IO32	= 0x324,
+	ATA_IOC_GET_IO32	= 0x309, /* HDIO_GET_32BIT */
+	ATA_IOC_SET_IO32	= 0x324, /* HDIO_SET_32BIT */
 };
 
 /* core structures */
-- 
2.7.0

Thread

[3.13.y-ckt stable] Linux 3.13.11-ckt37 stable review Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:10 +0100
  [PATCH 3.13.y-ckt 38/43] ext4: iterate over buffer heads correctly in move_extent_per_page() Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:10 +0100
  [PATCH 3.13.y-ckt 39/43] net/mlx4_core: Allow resetting VF admin mac to zero Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:10 +0100
  [PATCH 3.13.y-ckt 43/43] IB/core: Use GRH when the path hop-limit > 0 Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:10 +0100
  [PATCH 3.13.y-ckt 32/43] PM / sleep / x86: Fix crash on graph trace through x86 suspend Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:10 +0100
  [PATCH 3.13.y-ckt 25/43] ASoC: wm8994: Fix enum ctl accesses in a wrong type Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:10 +0100
  [PATCH 3.13.y-ckt 30/43] drm/ast: Fix incorrect register check for DRAM width Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:10 +0100
  [PATCH 3.13.y-ckt 34/43] MIPS: traps: Fix SIGFPE information leak from `do_ov' and `do_trap_or_bp' Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:10 +0100
  [PATCH 3.13.y-ckt 18/43] cifs: fix out-of-bounds access in lease parsing Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 13/43] vfio: fix ioctl error handling Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 20/43] ALSA: hdspm: Fix wrong boolean ctl value accesses Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 23/43] USB: cp210x: Add ID for Parrot NMEA GPS Flight Recorder Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 16/43] ALSA: timer: Fix broken compat timer user status ioctl Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 05/43] mac80211: fix use of uninitialised values in RX aggregation Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 22/43] ALSA: hdsp: Fix wrong boolean ctl value accesses Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 24/43] ASoC: wm8958: Fix enum ctl accesses in a wrong type Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 08/43] Revert "jffs2: Fix lock acquisition order bug in jffs2_write_begin" Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 02/43] Input: aiptek - fix crash on detecting device without endpoints Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 07/43] mac80211: minstrel_ht: set default tx aggregation timeout to 0 Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 17/43] ALSA: timer: Fix ioctls for X32 ABI Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 11/43] iommu/amd: Fix boot warning when device 00:00.0 is not iommu covered Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 01/43] [stable-only] AIO: properly check iovec sizes Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 14/43] ALSA: ctl: Fix ioctls for X32 ABI Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 04/43] cfg80211/wext: fix message ordering Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 06/43] libata: fix HDIO_GET_32BIT ioctl Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 10/43] Fix directory hardlinks from deleted directories Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 15/43] ALSA: rawmidi: Fix ioctls X32 ABI Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 27/43] USB: serial: option: add support for Telit LE922 PID 0x1045 Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 09/43] jffs2: Fix page lock / f->sem deadlock Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 19/43] CIFS: Fix SMB2+ interim response processing for read requests Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 26/43] ASoC: wm_adsp: Fix enum ctl accesses in a wrong type Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100

csiph-web