From: Paolo Bonzini <pbonzini@redhat.com>
To: linux-kernel@vger.kernel.org
Cc: tj@kernel.org
Subject: [PATCH v3 part1 0/4] Fix SG_IO ambiguity between READ SUBCHANNEL and UNMAP (and other similar cases)
Date: Thu, 23 May 2013 15:58:19 +0200 [thread overview]
Message-ID: <1369317503-4095-1-git-send-email-pbonzini@redhat.com> (raw)
The SG_IO ioctl's command whitelist is designed for MMC devices (roughly,
"play/burn CDs without requiring root") but some opcodes overlap across SCSI
device classes and have different meanings for different classes.
To fix this, use different bitmaps for the various device classes.
This is CVE-2012-4542.
v2->v3: patches are now split differently, according to Tejun's indications;
added conflict on operation code A4h.
Paolo Bonzini (4):
sg_io: pass request_queue to blk_verify_command
sg_io: prepare to introduce per-class command filters
sg_io: use different default filters for each device class
sg_io: resolve conflicts between commands assigned to multiple classes
(CVE-2012-4542)
block/bsg.c | 2 +-
block/scsi_ioctl.c | 193 +++++++++++++++++++++++++++--------------------
drivers/scsi/scsi_scan.c | 2 +
drivers/scsi/sg.c | 3 +-
include/linux/blkdev.h | 5 +-
5 files changed, 118 insertions(+), 87 deletions(-)
--
1.8.1.4
next reply other threads:[~2013-05-23 13:58 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-05-23 13:58 Paolo Bonzini [this message]
2013-05-23 13:58 ` [PATCH v3 part1 1/4] sg_io: pass request_queue to blk_verify_command Paolo Bonzini
2013-05-24 7:36 ` James Bottomley
2013-05-24 7:43 ` Paolo Bonzini
2013-05-24 7:50 ` James Bottomley
2013-05-24 7:53 ` Paolo Bonzini
2013-05-24 8:03 ` James Bottomley
2013-05-24 8:32 ` Paolo Bonzini
2013-05-24 21:41 ` Paolo Bonzini
2013-05-25 4:14 ` James Bottomley
2013-05-25 6:18 ` Paolo Bonzini
2013-05-23 13:58 ` [PATCH v3 part1 2/4] sg_io: prepare to introduce per-class command filters Paolo Bonzini
2013-05-23 13:58 ` [PATCH v3 part1 3/4] sg_io: use different default filters for each device class Paolo Bonzini
2013-05-23 13:58 ` [PATCH v3 part1 4/4] sg_io: resolve conflicts between commands assigned to multiple classes (CVE-2012-4542) Paolo Bonzini
2014-08-27 9:34 ` [PATCH v3 part1 0/4] Fix SG_IO ambiguity between READ SUBCHANNEL and UNMAP (and other similar cases) Luis Henriques
2014-08-27 10:09 ` Paolo Bonzini
2014-08-27 12:08 ` Luis Henriques
2014-08-27 17:47 ` Christoph Hellwig
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1369317503-4095-1-git-send-email-pbonzini@redhat.com \
--to=pbonzini@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=tj@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®