From owner-svn-src-stable-11@freebsd.org Wed Mar 14 09:57:59 2018 Return-Path: Delivered-To: svn-src-stable-11@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 4C99AF3F9EF; Wed, 14 Mar 2018 09:57:59 +0000 (UTC) (envelope-from tijl@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id EE6947871D; Wed, 14 Mar 2018 09:57:58 +0000 (UTC) (envelope-from tijl@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id E94B926627; Wed, 14 Mar 2018 09:57:58 +0000 (UTC) (envelope-from tijl@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id w2E9vweD038727; Wed, 14 Mar 2018 09:57:58 GMT (envelope-from tijl@FreeBSD.org) Received: (from tijl@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id w2E9vwxO038725; Wed, 14 Mar 2018 09:57:58 GMT (envelope-from tijl@FreeBSD.org) Message-Id: <201803140957.w2E9vwxO038725@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: tijl set sender to tijl@FreeBSD.org using -f From: Tijl Coosemans Date: Wed, 14 Mar 2018 09:57:58 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-11@freebsd.org Subject: svn commit: r330926 - in stable/11/sys/cam: . scsi X-SVN-Group: stable-11 X-SVN-Commit-Author: tijl X-SVN-Commit-Paths: in stable/11/sys/cam: . scsi X-SVN-Commit-Revision: 330926 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-stable-11@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: SVN commit messages for only the 11-stable src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Mar 2018 09:57:59 -0000 Author: tijl Date: Wed Mar 14 09:57:58 2018 New Revision: 330926 URL: https://svnweb.freebsd.org/changeset/base/330926 Log: MFC r314624: Reject userland CCBs that have CAM_UNLOCKED set. CAM_UNLOCKED is internal flag and cannot correctly be set by userland. Return EINVAL from CAMIOCOMMAND and CAMIOQUEUE if it is set. Also fix leaks in some of the error paths for CAMIOQUEUE. PR: 215356 Modified: stable/11/sys/cam/cam_xpt.c stable/11/sys/cam/scsi/scsi_pass.c Directory Properties: stable/11/ (props changed) Modified: stable/11/sys/cam/cam_xpt.c ============================================================================== --- stable/11/sys/cam/cam_xpt.c Wed Mar 14 09:20:03 2018 (r330925) +++ stable/11/sys/cam/cam_xpt.c Wed Mar 14 09:57:58 2018 (r330926) @@ -414,6 +414,9 @@ xptdoioctl(struct cdev *dev, u_long cmd, caddr_t addr, inccb = (union ccb *)addr; + if (inccb->ccb_h.flags & CAM_UNLOCKED) + return (EINVAL); + bus = xpt_find_bus(inccb->ccb_h.path_id); if (bus == NULL) return (EINVAL); Modified: stable/11/sys/cam/scsi/scsi_pass.c ============================================================================== --- stable/11/sys/cam/scsi/scsi_pass.c Wed Mar 14 09:20:03 2018 (r330925) +++ stable/11/sys/cam/scsi/scsi_pass.c Wed Mar 14 09:57:58 2018 (r330926) @@ -1798,6 +1798,11 @@ passdoioctl(struct cdev *dev, u_long cmd, caddr_t addr inccb = (union ccb *)addr; + if (inccb->ccb_h.flags & CAM_UNLOCKED) { + error = EINVAL; + break; + } + /* * Some CCB types, like scan bus and scan lun can only go * through the transport layer device. @@ -1891,20 +1896,23 @@ passdoioctl(struct cdev *dev, u_long cmd, caddr_t addr xpt_print(periph->path, "Copy of user CCB %p to " "kernel address %p failed with error %d\n", *user_ccb, ccb, error); - uma_zfree(softc->pass_zone, io_req); - cam_periph_lock(periph); - break; + goto camioqueue_error; } + if (ccb->ccb_h.flags & CAM_UNLOCKED) { + error = EINVAL; + goto camioqueue_error; + } + if (ccb->ccb_h.flags & CAM_CDB_POINTER) { if (ccb->csio.cdb_len > IOCDBLEN) { error = EINVAL; - break; + goto camioqueue_error; } error = copyin(ccb->csio.cdb_io.cdb_ptr, ccb->csio.cdb_io.cdb_bytes, ccb->csio.cdb_len); - if (error) - break; + if (error != 0) + goto camioqueue_error; ccb->ccb_h.flags &= ~CAM_CDB_POINTER; } @@ -1916,10 +1924,8 @@ passdoioctl(struct cdev *dev, u_long cmd, caddr_t addr xpt_print(periph->path, "CCB function code %#x is " "restricted to the XPT device\n", ccb->ccb_h.func_code); - uma_zfree(softc->pass_zone, io_req); - cam_periph_lock(periph); error = ENODEV; - break; + goto camioqueue_error; } /* @@ -1966,11 +1972,8 @@ passdoioctl(struct cdev *dev, u_long cmd, caddr_t addr || (fc == XPT_DEV_ADVINFO) || (fc == XPT_NVME_ADMIN) || (fc == XPT_NVME_IO)) { error = passmemsetup(periph, io_req); - if (error != 0) { - uma_zfree(softc->pass_zone, io_req); - cam_periph_lock(periph); - break; - } + if (error != 0) + goto camioqueue_error; } else io_req->mapinfo.num_bufs_used = 0; @@ -2014,6 +2017,11 @@ passdoioctl(struct cdev *dev, u_long cmd, caddr_t addr TAILQ_REMOVE(&softc->active_queue, io_req, links); TAILQ_INSERT_TAIL(&softc->done_queue, io_req, links); } + break; + +camioqueue_error: + uma_zfree(softc->pass_zone, io_req); + cam_periph_lock(periph); break; } case CAMIOGET: