Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1728925

[PATCH 4.13 43/47] scsi: sg: protect against races between mmap() and SG_SET_RESERVED_SIZE

Show all headers | View raw

4.13-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Todd Poynor <toddpoynor@google.com>

commit 6a8dadcca81fceff9976e8828cceb072873b7bd5 upstream.

Take f_mutex around mmap() processing to protect against races with the
SG_SET_RESERVED_SIZE ioctl.  Ensure the reserve buffer length remains
consistent during the mapping operation, and set the "mmap called" flag
to prevent further changes to the reserved buffer size as an atomic
operation with the mapping.

[mkp: fixed whitespace]

Signed-off-by: Todd Poynor <toddpoynor@google.com>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/scsi/sg.c |   12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -1233,6 +1233,7 @@ sg_mmap(struct file *filp, struct vm_are
 	unsigned long req_sz, len, sa;
 	Sg_scatter_hold *rsv_schp;
 	int k, length;
+	int ret = 0;
 
 	if ((!filp) || (!vma) || (!(sfp = (Sg_fd *) filp->private_data)))
 		return -ENXIO;
@@ -1243,8 +1244,11 @@ sg_mmap(struct file *filp, struct vm_are
 	if (vma->vm_pgoff)
 		return -EINVAL;	/* want no offset */
 	rsv_schp = &sfp->reserve;
-	if (req_sz > rsv_schp->bufflen)
-		return -ENOMEM;	/* cannot map more than reserved buffer */
+	mutex_lock(&sfp->f_mutex);
+	if (req_sz > rsv_schp->bufflen) {
+		ret = -ENOMEM;	/* cannot map more than reserved buffer */
+		goto out;
+	}
 
 	sa = vma->vm_start;
 	length = 1 << (PAGE_SHIFT + rsv_schp->page_order);
@@ -1258,7 +1262,9 @@ sg_mmap(struct file *filp, struct vm_are
 	vma->vm_flags |= VM_IO | VM_DONTEXPAND | VM_DONTDUMP;
 	vma->vm_private_data = sfp;
 	vma->vm_ops = &sg_mmap_vm_ops;
-	return 0;
+out:
+	mutex_unlock(&sfp->f_mutex);
+	return ret;
 }
 
 static void

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.13 00/47] 4.13.1-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:30 +0200
  [PATCH 4.13 14/47] iio: adc: ti-ads1015: enable conversion when CONFIG_PM is not set Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:30 +0200
  [PATCH 4.13 10/47] staging: ccree: save ciphertext for CTS IV Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:30 +0200
  [PATCH 4.13 24/47] fpga: altera-hps2fpga: fix multiple init of l3_remap_lock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:30 +0200
  [PATCH 4.13 12/47] iio: adc: ti-ads1015: fix incorrect data rate setting update Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:30 +0200
  [PATCH 4.13 42/47] cs5536: add support for IDE controller variant Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:30 +0200
  [PATCH 4.13 16/47] iio: adc: ti-ads1015: dont return invalid value from buffer setup callbacks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:30 +0200
  [PATCH 4.13 33/47] iwlwifi: pci: add new PCI ID for 7265D Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:30 +0200
  [PATCH 4.13 36/47] MCB: add support for SC31 to mcb-lpc Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:30 +0200
  [PATCH 4.13 41/47] ahci: dont use MSI for devices with the silly Intel NVMe remapping scheme Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:30 +0200
  [PATCH 4.13 09/47] staging/rts5208: fix incorrect shift to extract upper nybble Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:30 +0200
  [PATCH 4.13 35/47] mwifiex: correct channel stat buffer overflows Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:30 +0200
  [PATCH 4.13 39/47] drm/nouveau: Fix error handling in nv50_disp_atomic_commit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:30 +0200
  [PATCH 4.13 01/47] usb: quirks: add delay init quirk for Corsair Strafe RGB keyboard Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:30 +0200
  [PATCH 4.13 40/47] workqueue: Fix flag collision Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:30 +0200
  [PATCH 4.13 19/47] HID: wacom: Do not completely map WACOM_HID_WD_TOUCHRINGSTATUS usage Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:30 +0200
  [PATCH 4.13 18/47] driver core: bus: Fix a potential double free Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:30 +0200
  [PATCH 4.13 37/47] s390/mm: avoid empty zero pages for KVM guests to avoid postcopy hangs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:50 +0200
  [PATCH 4.13 23/47] thunderbolt: Fix reset response_type Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:50 +0200
  [PATCH 4.13 25/47] intel_th: pci: Add Cannon Lake PCH-H support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:50 +0200
  [PATCH 4.13 44/47] scsi: sg: recheck MMAP_IO request length with lock held Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:50 +0200
  [PATCH 4.13 46/47] rtlwifi: Fix memory leak when firmware request fails Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:50 +0200
  [PATCH 4.13 31/47] rtlwifi: rtl_pci_probe: Fix fail path of _rtl_pci_find_adapter Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:50 +0200
  [PATCH 4.13 28/47] drm/vgem: Pin our pages for dmabuf exports Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:50 +0200
  [PATCH 4.13 38/47] drm/nouveau/pci/msi: disable MSI on big-endian platforms by default Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:50 +0200
  [PATCH 4.13 26/47] intel_th: pci: Add Cannon Lake PCH-LP support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:50 +0200
  [PATCH 4.13 27/47] ath10k: fix memory leak in rx ring buffer allocation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:50 +0200
  [PATCH 4.13 47/47] rtlwifi: Fix fallback firmware loading Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:50 +0200
  [PATCH 4.13 43/47] scsi: sg: protect against races between mmap() and SG_SET_RESERVED_SIZE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:50 +0200
  [PATCH 4.13 45/47] of/device: Prevent buffer overflow in of_device_modalias() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:50 +0200
  [PATCH 4.13 32/47] Bluetooth: Add support of 13d3:3494 RTL8723BE device Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 15:50 +0200
  [PATCH 4.13 20/47] binder: free memory on error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 16:00 +0200
  [PATCH 4.13 15/47] iio: adc: ti-ads1015: avoid getting stale result after runtime resume Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 16:00 +0200
  [PATCH 4.13 03/47] usb: Add device quirk for Logitech HD Pro Webcam C920-C Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 16:00 +0200
  [PATCH 4.13 13/47] iio: adc: ti-ads1015: fix scale information for ADS1115 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 16:00 +0200
  [PATCH 4.13 08/47] USB: core: Avoid race of async_completed() w/ usbdev_release() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 16:00 +0200
  [PATCH 4.13 04/47] usb:xhci:Fix regression when ATI chipsets detected Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 16:00 +0200
  [PATCH 4.13 05/47] USB: musb: fix external abort on suspend Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 16:00 +0200
  [PATCH 4.13 07/47] ANDROID: binder: add hwbinder,vndbinder to BINDER_DEVICES. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 16:00 +0200
  [PATCH 4.13 17/47] iio: adc: ti-ads1015: add adequate wait time to get correct conversion Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 16:00 +0200
  [PATCH 4.13 06/47] ANDROID: binder: add padding to binder_fd_array_object. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 16:00 +0200
  [PATCH 4.13 02/47] USB: serial: option: add support for D-Link DWM-157 C1 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-08 16:00 +0200
  Re: [PATCH 4.13 00/47] 4.13.1-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-09-08 19:00 +0200
    Re: [PATCH 4.13 00/47] 4.13.1-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-09 07:50 +0200
  Re: [PATCH 4.13 00/47] 4.13.1-stable review Guenter Roeck <linux@roeck-us.net> - 2017-09-09 15:50 +0200
    Re: [PATCH 4.13 00/47] 4.13.1-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-09 16:20 +0200

csiph-web