]> www.infradead.org Git - users/jedix/linux-maple.git/commit
sg_write()/bsg_write() is not fit to be called under KERNEL_DS
authorAl Viro <viro@zeniv.linux.org.uk>
Fri, 16 Dec 2016 18:42:06 +0000 (13:42 -0500)
committerChuck Anderson <chuck.anderson@oracle.com>
Mon, 29 May 2017 01:14:47 +0000 (18:14 -0700)
commit10c56c65774e9e9882d82473dcb45cd6e68ec6c9
treee5c1c3741011d2449f360a51d6de13e8cb54b7fd
parente84003752cd5ef11857bea02cf7048e6a9228d4e
sg_write()/bsg_write() is not fit to be called under KERNEL_DS

Orabug: 25340071
CVE: CVE-2016-10088

Both damn things interpret userland pointers embedded into the payload;
worse, they are actually traversing those.  Leaving aside the bad
API design, this is very much _not_ safe to call with KERNEL_DS.
Bail out early if that happens.

Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
(cherry picked from commit 128394eff343fc6d2f32172f03e24829539c5835)
Signed-off-by: Brian Maly <brian.maly@oracle.com>
block/bsg.c
drivers/scsi/sg.c