From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751941AbdHCTDO (ORCPT ); Thu, 3 Aug 2017 15:03:14 -0400 Received: from mail-pf0-f178.google.com ([209.85.192.178]:36800 "EHLO mail-pf0-f178.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751251AbdHCTDM (ORCPT ); Thu, 3 Aug 2017 15:03:12 -0400 From: Nick Desaulniers Cc: hare@suse.de, jthumshirn@suse.de, hch@lst.de, salyzyn@google.com, gregkh@linuxfoundation.org, Robb Glasser , Nick Desaulniers , Doug Gilbert , "James E.J. Bottomley" , "Martin K. Petersen" , linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] scsi: sg: Prevent potential double frees in sg driver Date: Thu, 3 Aug 2017 12:02:47 -0700 Message-Id: <20170803190248.51537-1-ndesaulniers@google.com> X-Mailer: git-send-email 2.14.0.rc1.383.gd1ce394fe2-goog To: unlisted-recipients:; (no To-header on input) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Robb Glasser sg_ioctl could be spammed by requests, leading to a double free in __free_pages. This protects the entry points of sg_ioctl where the memory could be corrupted by a double call to __free_pages if multiple requests are happening concurrently. Signed-off-by: Robb Glasser Signed-off-by: Nick Desaulniers --- drivers/scsi/sg.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c index 4fe606b000b4..40fe71f4c863 100644 --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -883,8 +883,10 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg) return -ENXIO; if (!access_ok(VERIFY_WRITE, p, SZ_SG_IO_HDR)) return -EFAULT; + mutex_lock(&sfp->parentdp->open_rel_lock); result = sg_new_write(sfp, filp, p, SZ_SG_IO_HDR, 1, read_only, 1, &srp); + mutex_unlock(&sfp->parentdp->open_rel_lock); if (result < 0) return result; result = wait_event_interruptible(sfp->read_wait, -- 2.14.0.rc1.383.gd1ce394fe2-goog