[PATCH 2/3] cciss: bug fix for BIG_PASS_THRU

[PATCH 2/3] cciss: bug fix for BIG_PASS_THRU

[mikem]

Patch 2 of 3

Applications using CCISS_BIG_PASSTHRU complained that the data written
was zeros.  The code looked alright, but it seems that copy_from_user 
already does a memset on the buffer. Removing it from the pass-through
fixes the apps.

Please consider this for inclusion.

Signed-off-by: Mike Miller <mike.miller@hp.com>
--------------------------------------------------------------------------------

 drivers/block/cciss.c |    2 --
 1 files changed, 2 deletions(-)

diff -puN drivers/block/cciss.c~cciss_memset drivers/block/cciss.c
--- linux-2.6.14.2/drivers/block/cciss.c~cciss_memset	2005-11-15 15:41:23.289070160 -0600
+++ linux-2.6.14.2-mikem/drivers/block/cciss.c	2005-11-15 15:42:28.264192440 -0600
@@ -1020,8 +1020,6 @@ static int cciss_ioctl(struct inode *ino
 				copy_from_user(buff[sg_used], data_ptr, sz)) {
 					status = -ENOMEM;
 					goto cleanup1;			
-			} else {
-				memset(buff[sg_used], 0, sz);
 			}
 			left -= sz;
 			data_ptr += sz;
_

Re: [PATCH 2/3] cciss: bug fix for BIG_PASS_THRU

[Jens Axboe]

On Fri, Nov 18 2005, mikem wrote:
> Patch 2 of 3
> 
> Applications using CCISS_BIG_PASSTHRU complained that the data written
> was zeros.  The code looked alright, but it seems that copy_from_user 
> already does a memset on the buffer. Removing it from the pass-through
> fixes the apps.

Hmm, I don't like this patch, since you never clear the buffer for reads
now. If the controller for some reason doesn't overwrite this buffer,
you could be leaking privileged data! Your bug is because you do:

        if (write && copy_from_user(...))
                fail
        else
                clear

so you end up in the clear case for any case where copy_from_user()
doesn't fail. I've fixed it up for you, this is what I committed:

diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index e239a6c..33f8341 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -1017,10 +1017,11 @@ static int cciss_ioctl(struct inode *ino
 				status = -ENOMEM;
 				goto cleanup1;
 			}
-			if (ioc->Request.Type.Direction == XFER_WRITE &&
-				copy_from_user(buff[sg_used], data_ptr, sz)) {
+			if (ioc->Request.Type.Direction == XFER_WRITE) {
+				if (copy_from_user(buff[sg_used], data_ptr, sz)) {
 					status = -ENOMEM;
-					goto cleanup1;			
+					goto cleanup1;
+				}
 			} else {
 				memset(buff[sg_used], 0, sz);
 			}

-- 
Jens Axboe

Re: [PATCH 2/3] cciss: bug fix for BIG_PASS_THRU

[Philippe Pegon]

mikem wrote:
> Patch 2 of 3
> 
> Applications using CCISS_BIG_PASSTHRU complained that the data written
> was zeros.  The code looked alright, but it seems that copy_from_user 
> already does a memset on the buffer. Removing it from the pass-through
> fixes the apps.
> 
> Please consider this for inclusion.

thanks a lot

--
Philippe Pegon

Re: [PATCH 2/3] cciss: bug fix for BIG_PASS_THRU

[mikem]

On Fri, Nov 18, 2005 at 10:01:24PM +0100, Jens Axboe wrote:
> On Fri, Nov 18 2005, mikem wrote:
> > Patch 2 of 3
> > 
> > Applications using CCISS_BIG_PASSTHRU complained that the data written
> > was zeros.  The code looked alright, but it seems that copy_from_user 
> > already does a memset on the buffer. Removing it from the pass-through
> > fixes the apps.
> 
> Hmm, I don't like this patch, since you never clear the buffer for reads
> now. If the controller for some reason doesn't overwrite this buffer,
> you could be leaking privileged data! Your bug is because you do:
> 
>         if (write && copy_from_user(...))
>                 fail
>         else
>                 clear
> 
> so you end up in the clear case for any case where copy_from_user()
> doesn't fail. I've fixed it up for you, this is what I committed:

Thanks, Jens.

> 
> diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
> index e239a6c..33f8341 100644
> --- a/drivers/block/cciss.c
> +++ b/drivers/block/cciss.c
> @@ -1017,10 +1017,11 @@ static int cciss_ioctl(struct inode *ino
>  				status = -ENOMEM;
>  				goto cleanup1;
>  			}
> -			if (ioc->Request.Type.Direction == XFER_WRITE &&
> -				copy_from_user(buff[sg_used], data_ptr, sz)) {
> +			if (ioc->Request.Type.Direction == XFER_WRITE) {
> +				if (copy_from_user(buff[sg_used], data_ptr, sz)) {
>  					status = -ENOMEM;
> -					goto cleanup1;			
> +					goto cleanup1;
> +				}
>  			} else {
>  				memset(buff[sg_used], 0, sz);
>  			}
> 
> -- 
> Jens Axboe
>