Re: [PATCH] SCSI: fix unsafe operations related to sshdr in scsi_test_unit_ready()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is the recommended version in plain text, and thanks to FUJITA
for comment on issues related to DMA.
---

--- o/linux-2.6.36-rc1/drivers/scsi/scsi_lib.c	2010-08-16
08:41:38.000000000 +0800
+++ m/linux-2.6.36-rc1/drivers/scsi/scsi_lib.c	2010-09-18
09:17:36.000000000 +0800
@@ -1984,12 +1984,13 @@ scsi_test_unit_ready(struct scsi_device
 	char cmd[] = {
 		TEST_UNIT_READY, 0, 0, 0, 0, 0,
 	};
-	struct scsi_sense_hdr *sshdr;
+	struct scsi_sense_hdr *sshdr, hdr;
 	int result;

-	if (!sshdr_external)
-		sshdr = kzalloc(sizeof(*sshdr), GFP_KERNEL);
-	else
+	if (!sshdr_external) {
+		sshdr = &hdr;
+		memset(sshdr, 0, sizeof(*sshdr));
+	} else
 		sshdr = sshdr_external;

 	/* try to eat the UNIT_ATTENTION if there are enough retries */
@@ -2002,18 +2003,12 @@ scsi_test_unit_ready(struct scsi_device
 	} while (scsi_sense_valid(sshdr) &&
 		 sshdr->sense_key == UNIT_ATTENTION && --retries);

-	if (!sshdr)
-		/* could not allocate sense buffer, so can't process it */
-		return result;
-
 	if (sdev->removable && scsi_sense_valid(sshdr) &&
 	    (sshdr->sense_key == UNIT_ATTENTION ||
 	     sshdr->sense_key == NOT_READY)) {
 		sdev->changed = 1;
 		result = 0;
 	}
-	if (!sshdr_external)
-		kfree(sshdr);
 	return result;
 }
 EXPORT_SYMBOL(scsi_test_unit_ready);



On Tue, Sep 14, 2010 at 10:47 PM, James Bottomley
<James.Bottomley@xxxxxxx> wrote:
> On Tue, 2010-09-14 at 21:26 +0800, Hillf Danton wrote:
>> The kzalloc for sshdr is replaced with sshdr struct on stack, then it
>> looks safer.
>
> This premise is completely wrong.  There are lots of times stack can be
> wrong for driver code especially: DMA or aligment but for general code,
> since we went to 4k stacks we have very little space; a lot of arrays
> and structures got moved to kmalloc to reduce stack consumption.
>
>> Signed-off-by: Hillf Danton <dhillf@xxxxxxxxx>
>> ---
>>
>>
>> --- o/linux-2.6.36-rc1/drivers/scsi/scsi_lib.c 2010-08-16
>> 08:41:38.000000000 +0800
>> +++ m/linux-2.6.36-rc1/drivers/scsi/scsi_lib.c 2010-09-14
>> 21:03:34.000000000 +0800
>> @@ -1984,12 +1984,13 @@ scsi_test_unit_ready(struct scsi_device
>>   char cmd[] = {
>>   TEST_UNIT_READY, 0, 0, 0, 0, 0,
>>   };
>> - struct scsi_sense_hdr *sshdr;
>> + struct scsi_sense_hdr *sshdr, hdr;
>>   int result;
>>
>> - if (!sshdr_external)
>> - sshdr = kzalloc(sizeof(*sshdr), GFP_KERNEL);
>> - else
>> + if (!sshdr_external) {
>> + sshdr = &hdr;
>> + memset(sshdr,0,sizeof(*sshdr));
>> + } else
>
> And the patch is unapplyable: it looks like your mailer has elided all
> the tabs and broken some of the lines.  Please see
> Documentation/email-clients.txt for suggestions how to fix this.
>
> Finally, this didn't make it to linux-scsi because you sent it as an
> html message, which the list drops without comment ... you have to send
> text/plain only.
>
> James
>
>
>
>
--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [SCSI Target Devel]     [Linux SCSI Target Infrastructure]     [Kernel Newbies]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Linux IIO]     [Samba]     [Device Mapper]
  Powered by Linux