[LTP] [PATCH 1/2] ioctl_sg01: Allow using USB device again

[LTP] [PATCH 1/2] ioctl_sg01: Allow using USB device again

[Martin Doucha]

The failures when the ioctl_sg01 test tried to query a USB device
turned out to be another data leak. Allow using USB devices again
but keep the improved device lookup algorithm.

Signed-off-by: Martin Doucha <mdoucha@suse.cz>
---

Tested on kernels v4.4 and v6.12.

 testcases/kernel/syscalls/ioctl/ioctl_sg01.c | 29 ++++++--------------
 1 file changed, 8 insertions(+), 21 deletions(-)

diff --git a/testcases/kernel/syscalls/ioctl/ioctl_sg01.c b/testcases/kernel/syscalls/ioctl/ioctl_sg01.c
index dada174e0..9862d7324 100644
--- a/testcases/kernel/syscalls/ioctl/ioctl_sg01.c
+++ b/testcases/kernel/syscalls/ioctl/ioctl_sg01.c
@@ -30,7 +30,7 @@
 #include "tst_memutils.h"
 
 #define SYSDIR "/sys/block"
-#define BLOCKDIR "/sys/block/%s/device"
+#define BLOCKDIR "/sys/block/%s/device/generic"
 
 #define BUF_SIZE (128 * 4096)
 #define CMD_SIZE 6
@@ -41,14 +41,14 @@ static unsigned char command[CMD_SIZE];
 static struct sg_io_hdr query;
 
 /* TODO: split this off to a separate SCSI library? */
-static const char *find_generic_scsi_device(int access_flags, int skip_usb)
+static const char *find_generic_scsi_device(int access_flags)
 {
 	DIR *sysdir;
 	struct dirent *ent;
 	int tmpfd;
 	ssize_t length;
 	char *filename;
-	static char devpath[PATH_MAX], syspath[PATH_MAX];
+	static char devpath[PATH_MAX], genpath[PATH_MAX];
 
 	sysdir = opendir(SYSDIR);
 
@@ -60,28 +60,15 @@ static const char *find_generic_scsi_device(int access_flags, int skip_usb)
 		if (ent->d_name[0] == '.')
 			continue;
 
-		snprintf(syspath, PATH_MAX, BLOCKDIR, ent->d_name);
-		syspath[PATH_MAX - 1] = '\0';
-
-		/* Real device path matches the physical HW bus path */
-		if (!realpath(syspath, devpath))
-			continue;
-
-		strncat(devpath, "/generic", PATH_MAX - strlen(devpath) - 1);
+		snprintf(devpath, PATH_MAX, BLOCKDIR, ent->d_name);
 		devpath[PATH_MAX - 1] = '\0';
-		length = readlink(devpath, syspath, PATH_MAX - 1);
+		length = readlink(devpath, genpath, PATH_MAX - 1);
 
 		if (length < 0)
 			continue;
 
-		syspath[length] = '\0';
-		filename = basename(syspath);
-
-		/* USB devices often return HW info in SG_IO response buffer */
-		if (skip_usb && strstr(devpath, "/usb")) {
-			tst_res(TINFO, "Skipping USB device %s", filename);
-			continue;
-		}
+		genpath[length] = '\0';
+		filename = basename(genpath);
 
 		snprintf(devpath, PATH_MAX, "/dev/%s", filename);
 		/* access() makes incorrect assumptions about block devices */
@@ -121,7 +108,7 @@ static void dump_hex(const char *str, size_t size)
 
 static void setup(void)
 {
-	const char *devpath = find_generic_scsi_device(O_RDONLY, 1);
+	const char *devpath = find_generic_scsi_device(O_RDONLY);
 
 	if (!devpath)
 		tst_brk(TCONF, "Could not find any usable SCSI device");
-- 
2.52.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH 2/2] ioctl_sg01: Add git reference to USB data leak fix

[Martin Doucha]

Signed-off-by: Martin Doucha <mdoucha@suse.cz>
---
 testcases/kernel/syscalls/ioctl/ioctl_sg01.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/testcases/kernel/syscalls/ioctl/ioctl_sg01.c b/testcases/kernel/syscalls/ioctl/ioctl_sg01.c
index 9862d7324..3a8e0cf42 100644
--- a/testcases/kernel/syscalls/ioctl/ioctl_sg01.c
+++ b/testcases/kernel/syscalls/ioctl/ioctl_sg01.c
@@ -16,6 +16,12 @@
  *  Date:   Fri May 18 16:23:18 2018 +0200
  *
  *  scsi: sg: allocate with __GFP_ZERO in sg_build_indirect()
+ *
+ *  commit 41e99fe2005182139b1058db71f0d241f8f0078c
+ *  Author: Desnes Nunes <desnesn@redhat.com>
+ *  Date:   Fri Oct 31 01:34:36 2025 -0300
+ *
+ *  usb: storage: Fix memory leak in USB bulk transport
  */
 
 #include <sys/types.h>
@@ -167,6 +173,7 @@ static struct tst_test test = {
 	.timeout = 3600,
 	.tags = (const struct tst_tag[]) {
 		{"linux-git", "a45b599ad808"},
+		{"linux-git", "41e99fe20051"},
 		{"CVE", "2018-1000204"},
 		{}
 	}
-- 
2.52.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH 1/2] ioctl_sg01: Allow using USB device again

[Cyril Hrubis]

Hi!
> The failures when the ioctl_sg01 test tried to query a USB device
> turned out to be another data leak. Allow using USB devices again
> but keep the improved device lookup algorithm.
> 
> Signed-off-by: Martin Doucha <mdoucha@suse.cz>
> ---
> 
> Tested on kernels v4.4 and v6.12.
> 
>  testcases/kernel/syscalls/ioctl/ioctl_sg01.c | 29 ++++++--------------
>  1 file changed, 8 insertions(+), 21 deletions(-)
> 
> diff --git a/testcases/kernel/syscalls/ioctl/ioctl_sg01.c b/testcases/kernel/syscalls/ioctl/ioctl_sg01.c
> index dada174e0..9862d7324 100644
> --- a/testcases/kernel/syscalls/ioctl/ioctl_sg01.c
> +++ b/testcases/kernel/syscalls/ioctl/ioctl_sg01.c
> @@ -30,7 +30,7 @@
>  #include "tst_memutils.h"
>  
>  #define SYSDIR "/sys/block"
> -#define BLOCKDIR "/sys/block/%s/device"
> +#define BLOCKDIR "/sys/block/%s/device/generic"
>  
>  #define BUF_SIZE (128 * 4096)
>  #define CMD_SIZE 6
> @@ -41,14 +41,14 @@ static unsigned char command[CMD_SIZE];
>  static struct sg_io_hdr query;
>  
>  /* TODO: split this off to a separate SCSI library? */
> -static const char *find_generic_scsi_device(int access_flags, int skip_usb)
> +static const char *find_generic_scsi_device(int access_flags)
>  {
>  	DIR *sysdir;
>  	struct dirent *ent;
>  	int tmpfd;
>  	ssize_t length;
>  	char *filename;
> -	static char devpath[PATH_MAX], syspath[PATH_MAX];
> +	static char devpath[PATH_MAX], genpath[PATH_MAX];
>  
>  	sysdir = opendir(SYSDIR);
>  
> @@ -60,28 +60,15 @@ static const char *find_generic_scsi_device(int access_flags, int skip_usb)
>  		if (ent->d_name[0] == '.')
>  			continue;
>  
> -		snprintf(syspath, PATH_MAX, BLOCKDIR, ent->d_name);
> -		syspath[PATH_MAX - 1] = '\0';
> -
> -		/* Real device path matches the physical HW bus path */
> -		if (!realpath(syspath, devpath))
> -			continue;
> -
> -		strncat(devpath, "/generic", PATH_MAX - strlen(devpath) - 1);
> +		snprintf(devpath, PATH_MAX, BLOCKDIR, ent->d_name);
>  		devpath[PATH_MAX - 1] = '\0';
> -		length = readlink(devpath, syspath, PATH_MAX - 1);
> +		length = readlink(devpath, genpath, PATH_MAX - 1);
>  
>  		if (length < 0)
>  			continue;
>  
> -		syspath[length] = '\0';
> -		filename = basename(syspath);
> -
> -		/* USB devices often return HW info in SG_IO response buffer */
> -		if (skip_usb && strstr(devpath, "/usb")) {
> -			tst_res(TINFO, "Skipping USB device %s", filename);
> -			continue;
> -		}
> +		genpath[length] = '\0';
> +		filename = basename(genpath);
>  
>  		snprintf(devpath, PATH_MAX, "/dev/%s", filename);
>  		/* access() makes incorrect assumptions about block devices */
> @@ -121,7 +108,7 @@ static void dump_hex(const char *str, size_t size)

I just wonder, shouldn't we find all the devices on the system and
return array of strings? Or at least pick at least one device per
differet bus?

-- 
Cyril Hrubis
chrubis@suse.cz

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH 1/2] ioctl_sg01: Allow using USB device again

[Martin Doucha]

On 1/26/26 17:42, Cyril Hrubis wrote:
> Hi!
> 
> I just wonder, shouldn't we find all the devices on the system and
> return array of strings? Or at least pick at least one device per
> differet bus?
> 

I plan to implement that later, this is a quick fix before release. I 
don't want to make too many changes on a short notice.

-- 
Martin Doucha   mdoucha@suse.cz
SW Quality Engineer
SUSE LINUX, s.r.o.
CORSO IIa
Krizikova 148/34
186 00 Prague 8
Czech Republic

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH 1/2] ioctl_sg01: Allow using USB device again

[Cyril Hrubis]

Hi!
> I plan to implement that later, this is a quick fix before release. I 
> don't want to make too many changes on a short notice.

Ack. With that:

Reviewed-by: Cyril Hrubis <chrubis@suse.cz>

-- 
Cyril Hrubis
chrubis@suse.cz

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH 1/2] ioctl_sg01: Allow using USB device again

[Petr Vorel]

Hi Martin,

patchset merged, thank you!

Kind regards,
Petr

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp