Commit 28676d86 authored by Johannes Thumshirn's avatar Johannes Thumshirn Committed by Martin K. Petersen

scsi: sg: check for valid direction before starting the request

Check for a valid direction before starting the request, otherwise we
risk running into an assertion in the scsi midlayer checking for valid
requests.

[mkp: fixed typo]
Signed-off-by: default avatarJohannes Thumshirn <jthumshirn@suse.de>
Link: http://www.spinics.net/lists/linux-scsi/msg104400.htmlReported-by: default avatarDmitry Vyukov <dvyukov@google.com>
Signed-off-by: default avatarHannes Reinecke <hare@suse.com>
Tested-by: default avatarJohannes Thumshirn <jthumshirn@suse.de>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 1bc0eb04
...@@ -663,8 +663,6 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos) ...@@ -663,8 +663,6 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos)
* is a non-zero input_size, so emit a warning. * is a non-zero input_size, so emit a warning.
*/ */
if (hp->dxfer_direction == SG_DXFER_TO_FROM_DEV) { if (hp->dxfer_direction == SG_DXFER_TO_FROM_DEV) {
static char cmd[TASK_COMM_LEN];
if (strcmp(current->comm, cmd)) {
printk_ratelimited(KERN_WARNING printk_ratelimited(KERN_WARNING
"sg_write: data in/out %d/%d bytes " "sg_write: data in/out %d/%d bytes "
"for SCSI command 0x%x-- guessing " "for SCSI command 0x%x-- guessing "
...@@ -673,8 +671,6 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos) ...@@ -673,8 +671,6 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos)
old_hdr.reply_len - (int)SZ_SG_HEADER, old_hdr.reply_len - (int)SZ_SG_HEADER,
input_size, (unsigned int) cmnd[0], input_size, (unsigned int) cmnd[0],
current->comm); current->comm);
strcpy(cmd, current->comm);
}
} }
k = sg_common_write(sfp, srp, cmnd, sfp->timeout, blocking); k = sg_common_write(sfp, srp, cmnd, sfp->timeout, blocking);
return (k < 0) ? k : count; return (k < 0) ? k : count;
...@@ -753,6 +749,29 @@ sg_new_write(Sg_fd *sfp, struct file *file, const char __user *buf, ...@@ -753,6 +749,29 @@ sg_new_write(Sg_fd *sfp, struct file *file, const char __user *buf,
return count; return count;
} }
static bool sg_is_valid_dxfer(sg_io_hdr_t *hp)
{
switch (hp->dxfer_direction) {
case SG_DXFER_NONE:
if (hp->dxferp || hp->dxfer_len > 0)
return false;
return true;
case SG_DXFER_TO_DEV:
case SG_DXFER_FROM_DEV:
case SG_DXFER_TO_FROM_DEV:
if (!hp->dxferp || hp->dxfer_len == 0)
return false;
return true;
case SG_DXFER_UNKNOWN:
if ((!hp->dxferp && hp->dxfer_len) ||
(hp->dxferp && hp->dxfer_len == 0))
return false;
return true;
default:
return false;
}
}
static int static int
sg_common_write(Sg_fd * sfp, Sg_request * srp, sg_common_write(Sg_fd * sfp, Sg_request * srp,
unsigned char *cmnd, int timeout, int blocking) unsigned char *cmnd, int timeout, int blocking)
...@@ -773,6 +792,9 @@ sg_common_write(Sg_fd * sfp, Sg_request * srp, ...@@ -773,6 +792,9 @@ sg_common_write(Sg_fd * sfp, Sg_request * srp,
"sg_common_write: scsi opcode=0x%02x, cmd_size=%d\n", "sg_common_write: scsi opcode=0x%02x, cmd_size=%d\n",
(int) cmnd[0], (int) hp->cmd_len)); (int) cmnd[0], (int) hp->cmd_len));
if (!sg_is_valid_dxfer(hp))
return -EINVAL;
k = sg_start_req(srp, cmnd); k = sg_start_req(srp, cmnd);
if (k) { if (k) {
SCSI_LOG_TIMEOUT(1, sg_printk(KERN_INFO, sfp->parentdp, SCSI_LOG_TIMEOUT(1, sg_printk(KERN_INFO, sfp->parentdp,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment