Commit f930c704 authored by Johannes Thumshirn's avatar Johannes Thumshirn Committed by Martin K. Petersen

scsi: sg: only check for dxfer_len greater than 256M

Don't make any assumptions on the sg_io_hdr_t::dxfer_direction or the
sg_io_hdr_t::dxferp in order to determine if it is a valid request. The
only way we can check for bad requests is by checking if the length
exceeds 256M.
Signed-off-by: default avatarJohannes Thumshirn <jthumshirn@suse.de>
Fixes: 28676d86 (scsi: sg: check for valid direction before starting the
request)
Reported-by: default avatarJason L Tibbitts III <tibbs@math.uh.edu>
Tested-by: default avatarJason L Tibbitts III <tibbs@math.uh.edu>
Suggested-by: default avatarDoug Gilbert <dgilbert@interlog.com>
Cc: Doug Gilbert <dgilbert@interlog.com>
Cc: <stable@vger.kernel.org>
Reviewed-by: default avatarHannes Reinecke <hare@suse.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent e6fd916a
......@@ -751,35 +751,6 @@ sg_new_write(Sg_fd *sfp, struct file *file, const char __user *buf,
return count;
}
static bool sg_is_valid_dxfer(sg_io_hdr_t *hp)
{
switch (hp->dxfer_direction) {
case SG_DXFER_NONE:
if (hp->dxferp || hp->dxfer_len > 0)
return false;
return true;
case SG_DXFER_FROM_DEV:
/*
* for SG_DXFER_FROM_DEV we always set dxfer_len to > 0. dxferp
* can either be NULL or != NULL so there's no point in checking
* it either. So just return true.
*/
return true;
case SG_DXFER_TO_DEV:
case SG_DXFER_TO_FROM_DEV:
if (!hp->dxferp || hp->dxfer_len == 0)
return false;
return true;
case SG_DXFER_UNKNOWN:
if ((!hp->dxferp && hp->dxfer_len) ||
(hp->dxferp && hp->dxfer_len == 0))
return false;
return true;
default:
return false;
}
}
static int
sg_common_write(Sg_fd * sfp, Sg_request * srp,
unsigned char *cmnd, int timeout, int blocking)
......@@ -800,7 +771,7 @@ sg_common_write(Sg_fd * sfp, Sg_request * srp,
"sg_common_write: scsi opcode=0x%02x, cmd_size=%d\n",
(int) cmnd[0], (int) hp->cmd_len));
if (!sg_is_valid_dxfer(hp))
if (hp->dxfer_len >= SZ_256M)
return -EINVAL;
k = sg_start_req(srp, cmnd);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment