From: Greg Kroah-Hartman Date: Thu, 18 May 2017 07:59:52 +0000 (+0200) Subject: drop libata patch from 4.10 and 4.9 trees X-Git-Tag: v3.18.54~14 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=81343ca2f3b4f027c2f48d35bdd88ae9e4e61872;p=thirdparty%2Fkernel%2Fstable-queue.git drop libata patch from 4.10 and 4.9 trees --- diff --git a/queue-4.10/libata-reject-passthrough-write-same-requests.patch b/queue-4.10/libata-reject-passthrough-write-same-requests.patch deleted file mode 100644 index c374b543857..00000000000 --- a/queue-4.10/libata-reject-passthrough-write-same-requests.patch +++ /dev/null @@ -1,41 +0,0 @@ -From c6ade20f5e50e188d20b711a618b20dd1d50457e Mon Sep 17 00:00:00 2001 -From: Christoph Hellwig -Date: Tue, 25 Apr 2017 13:39:54 +0200 -Subject: libata: reject passthrough WRITE SAME requests - -From: Christoph Hellwig - -commit c6ade20f5e50e188d20b711a618b20dd1d50457e upstream. - -The WRITE SAME to TRIM translation rewrites the DATA OUT buffer. While -the SCSI code accomodates for this by passing a read-writable buffer -userspace applications don't cater for this behavior. In fact it can -be used to rewrite e.g. a readonly file through mmap and should be -considered as a security fix. - -Signed-off-by: Christoph Hellwig -Reviewed-by: Martin K. Petersen -Signed-off-by: Tejun Heo -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/ata/libata-scsi.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - ---- a/drivers/ata/libata-scsi.c -+++ b/drivers/ata/libata-scsi.c -@@ -3487,6 +3487,14 @@ static unsigned int ata_scsi_write_same_ - if (unlikely(!dev->dma_mode)) - goto invalid_opcode; - -+ /* -+ * We only allow sending this command through the block layer, -+ * as it modifies the DATA OUT buffer, which would corrupt user -+ * memory for SG_IO commands. -+ */ -+ if (unlikely(blk_rq_is_passthrough(scmd->request))) -+ goto invalid_opcode; -+ - if (unlikely(scmd->cmd_len < 16)) { - fp = 15; - goto invalid_fld; diff --git a/queue-4.10/series b/queue-4.10/series index 31b1066f9d7..cee62ed1923 100644 --- a/queue-4.10/series +++ b/queue-4.10/series @@ -84,4 +84,3 @@ tty-pty-fix-ldisc-flush-after-userspace-become-aware-of-the-data-already.patch bluetooth-fix-user-channel-for-32bit-userspace-on-64bit-kernel.patch bluetooth-hci_bcm-add-missing-tty-device-sanity-check.patch bluetooth-hci_intel-add-missing-tty-device-sanity-check.patch -libata-reject-passthrough-write-same-requests.patch diff --git a/queue-4.9/libata-reject-passthrough-write-same-requests.patch b/queue-4.9/libata-reject-passthrough-write-same-requests.patch deleted file mode 100644 index 39aab8357d8..00000000000 --- a/queue-4.9/libata-reject-passthrough-write-same-requests.patch +++ /dev/null @@ -1,41 +0,0 @@ -From c6ade20f5e50e188d20b711a618b20dd1d50457e Mon Sep 17 00:00:00 2001 -From: Christoph Hellwig -Date: Tue, 25 Apr 2017 13:39:54 +0200 -Subject: libata: reject passthrough WRITE SAME requests - -From: Christoph Hellwig - -commit c6ade20f5e50e188d20b711a618b20dd1d50457e upstream. - -The WRITE SAME to TRIM translation rewrites the DATA OUT buffer. While -the SCSI code accomodates for this by passing a read-writable buffer -userspace applications don't cater for this behavior. In fact it can -be used to rewrite e.g. a readonly file through mmap and should be -considered as a security fix. - -Signed-off-by: Christoph Hellwig -Reviewed-by: Martin K. Petersen -Signed-off-by: Tejun Heo -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/ata/libata-scsi.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - ---- a/drivers/ata/libata-scsi.c -+++ b/drivers/ata/libata-scsi.c -@@ -3405,6 +3405,14 @@ static unsigned int ata_scsi_write_same_ - if (unlikely(!dev->dma_mode)) - goto invalid_opcode; - -+ /* -+ * We only allow sending this command through the block layer, -+ * as it modifies the DATA OUT buffer, which would corrupt user -+ * memory for SG_IO commands. -+ */ -+ if (unlikely(blk_rq_is_passthrough(scmd->request))) -+ goto invalid_opcode; -+ - if (unlikely(scmd->cmd_len < 16)) { - fp = 15; - goto invalid_fld; diff --git a/queue-4.9/series b/queue-4.9/series index 8c7eb061eee..196f06fc785 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -72,4 +72,3 @@ tty-pty-fix-ldisc-flush-after-userspace-become-aware-of-the-data-already.patch bluetooth-fix-user-channel-for-32bit-userspace-on-64bit-kernel.patch bluetooth-hci_bcm-add-missing-tty-device-sanity-check.patch bluetooth-hci_intel-add-missing-tty-device-sanity-check.patch -libata-reject-passthrough-write-same-requests.patch