From mboxrd@z Thu Jan 1 00:00:00 1970 From: Hannes Reinecke Subject: [PATCHv3 0/6] sanitize sg Date: Fri, 3 Feb 2017 14:12:05 +0100 Message-ID: <1486127531-13716-1-git-send-email-hare@suse.de> Return-path: Received: from mx2.suse.de ([195.135.220.15]:57503 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752315AbdBCNMX (ORCPT ); Fri, 3 Feb 2017 08:12:23 -0500 Sender: linux-scsi-owner@vger.kernel.org List-Id: linux-scsi@vger.kernel.org To: "Martin K. Petersen" Cc: Christoph Hellwig , James Bottomley , Johannes Thumshirn , Doug Gilberg , linux-scsi@vger.kernel.org, Hannes Reinecke Hi all, the infamous syzkaller incovered some more issues in the sg driver. This patchset fixes those two issues (and adds a fix for yet another potential issue; checking for a NULL dxferp when dxfer_len is not 0). It also removes handling of the SET_FORCE_LOW_DMA ioctl, which never worked since the initial git checkin. And does some code cleanup by removing the private list implementation, using standard lists instead. As usual, comments and reviews are welcome. Changes to v1: - Include reviews from Christoph - Add patch to close race condition in sg_remove_sfp_usercontext() - Remove stale variable 'save_scat_len' Changes to v2: - Move misplaced hunk - Add Reviewed-by: and Tested-by: tags Hannes Reinecke (5): sg: disable SET_FORCE_LOW_DMA sg: remove 'save_scat_len' sg: protect accesses to 'reserved' page array sg: use standard lists for sg_requests sg: close race condition in sg_remove_sfp_usercontext() Johannes Thumshirn (1): sg: check for valid direction before starting the request drivers/scsi/sg.c | 284 +++++++++++++++++++++++++++--------------------------- include/scsi/sg.h | 1 - 2 files changed, 141 insertions(+), 144 deletions(-) -- 1.8.5.6