Messages in this thread | | | From | "Martin K. Petersen" <> | Subject | Re: [PATCH v2 0/3] scsi: qedf: sanitise uaccess | Date | Mon, 7 Aug 2023 22:50:29 -0400 |
| |
On Mon, 31 Jul 2023 10:40:31 +0200, Oleksandr Natalenko wrote:
> qedf driver, debugfs part of it specifically, touches __user pointers > directly for printing out info to userspace via sprintf(), which may > cause crash like this: > > BUG: unable to handle kernel paging request at 00007ffd1d6b43a0 > IP: [<ffffffffaa7a882a>] string.isra.7+0x6a/0xf0 > Oops: 0003 [#1] SMP > Call Trace: > [<ffffffffaa7a9f31>] vsnprintf+0x201/0x6a0 > [<ffffffffaa7aa556>] sprintf+0x56/0x80 > [<ffffffffc04227ed>] qedf_dbg_stop_io_on_error_cmd_read+0x6d/0x90 [qedf] > [<ffffffffaa65bb2f>] vfs_read+0x9f/0x170 > [<ffffffffaa65cb82>] SyS_pread64+0x92/0xc0 > > [...]
Applied to 6.6/scsi-queue, thanks!
[1/3] scsi: qedf: do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly https://git.kernel.org/mkp/scsi/c/7d3d20dee4f6 [2/3] scsi: qedf: do not touch __user pointer in qedf_dbg_debug_cmd_read() directly https://git.kernel.org/mkp/scsi/c/31b5991a9a91 [3/3] scsi: qedf: do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly https://git.kernel.org/mkp/scsi/c/25dbc20deab5
-- Martin K. Petersen Oracle Linux Engineering
| |