From: Greg Kroah-Hartman Date: Fri, 22 Sep 2017 11:18:54 +0000 (+0200) Subject: 4.4-stable patches X-Git-Tag: v3.18.72~13 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=7ceb36fa0a8646fa867fc9379024f1f3362a114e;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: scsi-qla2xxx-fix-an-integer-overflow-in-sysfs-code.patch scsi-sg-fixup-infoleak-when-using-sg_get_request_table.patch --- diff --git a/queue-4.4/scsi-qla2xxx-fix-an-integer-overflow-in-sysfs-code.patch b/queue-4.4/scsi-qla2xxx-fix-an-integer-overflow-in-sysfs-code.patch new file mode 100644 index 00000000000..d896f21b781 --- /dev/null +++ b/queue-4.4/scsi-qla2xxx-fix-an-integer-overflow-in-sysfs-code.patch @@ -0,0 +1,62 @@ +From e6f77540c067b48dee10f1e33678415bfcc89017 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 30 Aug 2017 16:30:35 +0300 +Subject: scsi: qla2xxx: Fix an integer overflow in sysfs code + +From: Dan Carpenter + +commit e6f77540c067b48dee10f1e33678415bfcc89017 upstream. + +The value of "size" comes from the user. When we add "start + size" it +could lead to an integer overflow bug. + +It means we vmalloc() a lot more memory than we had intended. I believe +that on 64 bit systems vmalloc() can succeed even if we ask it to +allocate huge 4GB buffers. So we would get memory corruption and likely +a crash when we call ha->isp_ops->write_optrom() and ->read_optrom(). + +Only root can trigger this bug. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=194061 + +Fixes: b7cc176c9eb3 ("[SCSI] qla2xxx: Allow region-based flash-part accesses.") +Reported-by: shqking +Signed-off-by: Dan Carpenter +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/qla2xxx/qla_attr.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/scsi/qla2xxx/qla_attr.c ++++ b/drivers/scsi/qla2xxx/qla_attr.c +@@ -404,6 +404,8 @@ qla2x00_sysfs_write_optrom_ctl(struct fi + return -EINVAL; + if (start > ha->optrom_size) + return -EINVAL; ++ if (size > ha->optrom_size - start) ++ size = ha->optrom_size - start; + + mutex_lock(&ha->optrom_mutex); + switch (val) { +@@ -429,8 +431,7 @@ qla2x00_sysfs_write_optrom_ctl(struct fi + } + + ha->optrom_region_start = start; +- ha->optrom_region_size = start + size > ha->optrom_size ? +- ha->optrom_size - start : size; ++ ha->optrom_region_size = start + size; + + ha->optrom_state = QLA_SREADING; + ha->optrom_buffer = vmalloc(ha->optrom_region_size); +@@ -503,8 +504,7 @@ qla2x00_sysfs_write_optrom_ctl(struct fi + } + + ha->optrom_region_start = start; +- ha->optrom_region_size = start + size > ha->optrom_size ? +- ha->optrom_size - start : size; ++ ha->optrom_region_size = start + size; + + ha->optrom_state = QLA_SWRITING; + ha->optrom_buffer = vmalloc(ha->optrom_region_size); diff --git a/queue-4.4/scsi-sg-fixup-infoleak-when-using-sg_get_request_table.patch b/queue-4.4/scsi-sg-fixup-infoleak-when-using-sg_get_request_table.patch new file mode 100644 index 00000000000..3d3575ef97d --- /dev/null +++ b/queue-4.4/scsi-sg-fixup-infoleak-when-using-sg_get_request_table.patch @@ -0,0 +1,46 @@ +From 3e0097499839e0fe3af380410eababe5a47c4cf9 Mon Sep 17 00:00:00 2001 +From: Hannes Reinecke +Date: Fri, 15 Sep 2017 14:05:16 +0200 +Subject: scsi: sg: fixup infoleak when using SG_GET_REQUEST_TABLE + +From: Hannes Reinecke + +commit 3e0097499839e0fe3af380410eababe5a47c4cf9 upstream. + +When calling SG_GET_REQUEST_TABLE ioctl only a half-filled table is +returned; the remaining part will then contain stale kernel memory +information. This patch zeroes out the entire table to avoid this +issue. + +Signed-off-by: Hannes Reinecke +Reviewed-by: Bart Van Assche +Reviewed-by: Christoph Hellwig +Reviewed-by: Eric Dumazet +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/sg.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/scsi/sg.c ++++ b/drivers/scsi/sg.c +@@ -850,7 +850,6 @@ sg_fill_request_table(Sg_fd *sfp, sg_req + list_for_each_entry(srp, &sfp->rq_list, entry) { + if (val > SG_MAX_QUEUE) + break; +- memset(&rinfo[val], 0, SZ_SG_REQ_INFO); + rinfo[val].req_state = srp->done + 1; + rinfo[val].problem = + srp->header.masked_status & +@@ -1067,8 +1066,8 @@ sg_ioctl(struct file *filp, unsigned int + else { + sg_req_info_t *rinfo; + +- rinfo = kmalloc(SZ_SG_REQ_INFO * SG_MAX_QUEUE, +- GFP_KERNEL); ++ rinfo = kzalloc(SZ_SG_REQ_INFO * SG_MAX_QUEUE, ++ GFP_KERNEL); + if (!rinfo) + return -ENOMEM; + read_lock_irqsave(&sfp->rq_list_lock, iflags); diff --git a/queue-4.4/series b/queue-4.4/series index 99cbb0dcb34..0b9b734792b 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -47,3 +47,5 @@ scsi-sg-remove-save_scat_len.patch scsi-sg-use-standard-lists-for-sg_requests.patch scsi-sg-off-by-one-in-sg_ioctl.patch scsi-sg-factor-out-sg_fill_request_table.patch +scsi-sg-fixup-infoleak-when-using-sg_get_request_table.patch +scsi-qla2xxx-fix-an-integer-overflow-in-sysfs-code.patch