sg_write()/bsg_write() is not fit to be called under KERNEL_DS
authorAl Viro <viro@zeniv.linux.org.uk>
Fri, 16 Dec 2016 18:42:06 +0000 (13:42 -0500)
committerBen Hutchings <ben@decadent.org.uk>
Thu, 23 Feb 2017 03:51:06 +0000 (03:51 +0000)
commite30250c95b840896da4cb71e84bead5803ee1ff6
tree82ce305998183031562b102d0b5546ebf8d8d190
parentba43cdd87d0aaed69ef1bb14a91c3e767a4c210f
sg_write()/bsg_write() is not fit to be called under KERNEL_DS

commit a0ac402cfcdc904f9772e1762b3fda112dcc56a0 upstream.

Both damn things interpret userland pointers embedded into the payload;
worse, they are actually traversing those.  Leaving aside the bad
API design, this is very much _not_ safe to call with KERNEL_DS.
Bail out early if that happens.

Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
block/bsg.c
drivers/scsi/sg.c