Re: [PATCH] fix vulnerability in file operations of scsi target interface

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is the refined version based upon the guidance of Joe, and is safer.

Signed-off-by: Hillf Danton <dhillf@xxxxxxxxx>
---

--- a/drivers/scsi/scsi_tgt_if.c	2010-11-01 19:54:12.000000000 +0800
+++ b/drivers/scsi/scsi_tgt_if.c	2010-11-16 22:10:20.000000000 +0800
@@ -84,7 +84,7 @@ static int tgt_uspace_send_event(u32 typ
 	if (!ev->hdr.status)
 		tgt_ring_idx_inc(ring);
 	else
-		err = -BUSY;
+		err = -EBUSY;

 	spin_unlock_irqrestore(&ring->tr_lock, flags);

@@ -318,9 +318,31 @@ static int tgt_mmap(struct file *filp, s
 	return err;
 }

+static unsigned long tgt_busy = 0;
+
 static int tgt_open(struct inode *inode, struct file *file)
 {
-	tx_ring.tr_idx = rx_ring.tr_idx = 0;
+	int err = -EBUSY;
+	unsigned long flags;
+
+	spin_lock_irqsave(&tx_ring.tr_lock, flags);
+	if (! tgt_busy) {
+		tgt_busy++;
+		tx_ring.tr_idx = rx_ring.tr_idx = 0;
+		err = 0;
+	}
+	spin_unlock_irqrestore(&tx_ring.tr_lock, flags);
+
+	return err;
+}
+
+static int tgt_release(struct inode *inode, struct file *file)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&tx_ring.tr_lock, flags);
+	tgt_busy = 0;
+	spin_unlock_irqrestore(&tx_ring.tr_lock, flags);

 	return 0;
 }
@@ -332,6 +354,7 @@ static const struct file_operations tgt_
 	.write		= tgt_write,
 	.mmap		= tgt_mmap,
 	.llseek		= noop_llseek,
+	.release	= tgt_release,
 };

 static struct miscdevice tgt_miscdev = {
--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [SCSI Target Devel]     [Linux SCSI Target Infrastructure]     [Kernel Newbies]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Linux IIO]     [Samba]     [Device Mapper]
  Powered by Linux