From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail177-1.suw61.mandrillapp.com ([198.2.177.1]:3941 "EHLO mail177-1.suw61.mandrillapp.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752797AbcCAIQX (ORCPT ); Tue, 1 Mar 2016 03:16:23 -0500 Received: from pmta06.mandrill.prod.suw01.rsglab.com (127.0.0.1) by mail177-1.suw61.mandrillapp.com id hql7te22rtko for ; Tue, 1 Mar 2016 08:16:04 +0000 (envelope-from ) From: Subject: Patch "megaraid_sas : SMAP restriction--do not access user memory from IOCTL code" has been added to the 3.10-stable tree To: , , , , Cc: , Message-Id: <14568176093749@kroah.com> Date: Tue, 01 Mar 2016 08:16:03 +0000 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled megaraid_sas : SMAP restriction--do not access user memory from IOCTL code to the 3.10-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: megaraid_sas-smap-restriction-do-not-access-user-memory-from-ioctl-code.patch and it can be found in the queue-3.10 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From 323c4a02c631d00851d8edc4213c4d184ef83647 Mon Sep 17 00:00:00 2001 From: "sumit.saxena@avagotech.com" Date: Thu, 15 Oct 2015 13:40:54 +0530 Subject: megaraid_sas : SMAP restriction--do not access user memory from IOCTL code From: sumit.saxena@avagotech.com commit 323c4a02c631d00851d8edc4213c4d184ef83647 upstream. This is an issue on SMAP enabled CPUs and 32 bit apps running on 64 bit OS. Do not access user memory from kernel code. The SMAP bit restricts accessing user memory from kernel code. Signed-off-by: Sumit Saxena Signed-off-by: Kashyap Desai Reviewed-by: Tomas Henzl Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman --- drivers/scsi/megaraid/megaraid_sas_base.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) --- a/drivers/scsi/megaraid/megaraid_sas_base.c +++ b/drivers/scsi/megaraid/megaraid_sas_base.c @@ -5051,6 +5051,9 @@ static int megasas_mgmt_compat_ioctl_fw( int i; int error = 0; compat_uptr_t ptr; + unsigned long local_raw_ptr; + u32 local_sense_off; + u32 local_sense_len; if (clear_user(ioc, sizeof(*ioc))) return -EFAULT; @@ -5068,9 +5071,15 @@ static int megasas_mgmt_compat_ioctl_fw( * sense_len is not null, so prepare the 64bit value under * the same condition. */ - if (ioc->sense_len) { + if (get_user(local_raw_ptr, ioc->frame.raw) || + get_user(local_sense_off, &ioc->sense_off) || + get_user(local_sense_len, &ioc->sense_len)) + return -EFAULT; + + + if (local_sense_len) { void __user **sense_ioc_ptr = - (void __user **)(ioc->frame.raw + ioc->sense_off); + (void __user **)((u8*)local_raw_ptr + local_sense_off); compat_uptr_t *sense_cioc_ptr = (compat_uptr_t *)(cioc->frame.raw + cioc->sense_off); if (get_user(ptr, sense_cioc_ptr) || Patches currently in stable-queue which might be from sumit.saxena@avagotech.com are queue-3.10/megaraid_sas-smap-restriction-do-not-access-user-memory-from-ioctl-code.patch queue-3.10/megaraid_sas-do-not-use-page_size-for-max_sectors.patch