Commit 323c4a02 authored by sumit.saxena@avagotech.com's avatar sumit.saxena@avagotech.com Committed by Martin K. Petersen

megaraid_sas : SMAP restriction--do not access user memory from IOCTL code

This is an issue on SMAP enabled CPUs and 32 bit apps running on 64 bit
OS. Do not access user memory from kernel code. The SMAP bit restricts
accessing user memory from kernel code.

Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarSumit Saxena <sumit.saxena@avagotech.com>
Signed-off-by: default avatarKashyap Desai <kashyap.desai@avagotech.com>
Reviewed-by: default avatarTomas Henzl <thenzl@redhat.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 0b48d12d
...@@ -6470,6 +6470,9 @@ static int megasas_mgmt_compat_ioctl_fw(struct file *file, unsigned long arg) ...@@ -6470,6 +6470,9 @@ static int megasas_mgmt_compat_ioctl_fw(struct file *file, unsigned long arg)
int i; int i;
int error = 0; int error = 0;
compat_uptr_t ptr; compat_uptr_t ptr;
unsigned long local_raw_ptr;
u32 local_sense_off;
u32 local_sense_len;
if (clear_user(ioc, sizeof(*ioc))) if (clear_user(ioc, sizeof(*ioc)))
return -EFAULT; return -EFAULT;
...@@ -6487,9 +6490,15 @@ static int megasas_mgmt_compat_ioctl_fw(struct file *file, unsigned long arg) ...@@ -6487,9 +6490,15 @@ static int megasas_mgmt_compat_ioctl_fw(struct file *file, unsigned long arg)
* sense_len is not null, so prepare the 64bit value under * sense_len is not null, so prepare the 64bit value under
* the same condition. * the same condition.
*/ */
if (ioc->sense_len) { if (get_user(local_raw_ptr, ioc->frame.raw) ||
get_user(local_sense_off, &ioc->sense_off) ||
get_user(local_sense_len, &ioc->sense_len))
return -EFAULT;
if (local_sense_len) {
void __user **sense_ioc_ptr = void __user **sense_ioc_ptr =
(void __user **)(ioc->frame.raw + ioc->sense_off); (void __user **)((u8*)local_raw_ptr + local_sense_off);
compat_uptr_t *sense_cioc_ptr = compat_uptr_t *sense_cioc_ptr =
(compat_uptr_t *)(cioc->frame.raw + cioc->sense_off); (compat_uptr_t *)(cioc->frame.raw + cioc->sense_off);
if (get_user(ptr, sense_cioc_ptr) || if (get_user(ptr, sense_cioc_ptr) ||
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment