From owner-svn-src-all@freebsd.org Fri Mar 3 20:51:58 2017 Return-Path: Delivered-To: svn-src-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 93EADCF7B8B; Fri, 3 Mar 2017 20:51:58 +0000 (UTC) (envelope-from markj@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 6C1811DE6; Fri, 3 Mar 2017 20:51:58 +0000 (UTC) (envelope-from markj@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id v23Kpv4R073637; Fri, 3 Mar 2017 20:51:57 GMT (envelope-from markj@FreeBSD.org) Received: (from markj@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id v23KpvIW073635; Fri, 3 Mar 2017 20:51:57 GMT (envelope-from markj@FreeBSD.org) Message-Id: <201703032051.v23KpvIW073635@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: markj set sender to markj@FreeBSD.org using -f From: Mark Johnston Date: Fri, 3 Mar 2017 20:51:57 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r314624 - in head/sys/cam: . scsi X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Mar 2017 20:51:58 -0000 Author: markj Date: Fri Mar 3 20:51:57 2017 New Revision: 314624 URL: https://svnweb.freebsd.org/changeset/base/314624 Log: Reject userland CCBs that have CAM_UNLOCKED set. CAM_UNLOCKED is internal flag and cannot correctly be set by userland. Return EINVAL from CAMIOCOMMAND and CAMIOQUEUE if it is set. Also fix leaks in some of the error paths for CAMIOQUEUE. PR: 215356 Reviewed by: ken, mav MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D9869 Modified: head/sys/cam/cam_xpt.c head/sys/cam/scsi/scsi_pass.c Modified: head/sys/cam/cam_xpt.c ============================================================================== --- head/sys/cam/cam_xpt.c Fri Mar 3 20:23:23 2017 (r314623) +++ head/sys/cam/cam_xpt.c Fri Mar 3 20:51:57 2017 (r314624) @@ -435,6 +435,9 @@ xptdoioctl(struct cdev *dev, u_long cmd, inccb->csio.bio = NULL; #endif + if (inccb->ccb_h.flags & CAM_UNLOCKED) + return (EINVAL); + bus = xpt_find_bus(inccb->ccb_h.path_id); if (bus == NULL) return (EINVAL); Modified: head/sys/cam/scsi/scsi_pass.c ============================================================================== --- head/sys/cam/scsi/scsi_pass.c Fri Mar 3 20:23:23 2017 (r314623) +++ head/sys/cam/scsi/scsi_pass.c Fri Mar 3 20:51:57 2017 (r314624) @@ -1782,6 +1782,11 @@ passdoioctl(struct cdev *dev, u_long cmd inccb->csio.bio = NULL; #endif + if (inccb->ccb_h.flags & CAM_UNLOCKED) { + error = EINVAL; + break; + } + /* * Some CCB types, like scan bus and scan lun can only go * through the transport layer device. @@ -1875,24 +1880,27 @@ passdoioctl(struct cdev *dev, u_long cmd xpt_print(periph->path, "Copy of user CCB %p to " "kernel address %p failed with error %d\n", *user_ccb, ccb, error); - uma_zfree(softc->pass_zone, io_req); - cam_periph_lock(periph); - break; + goto camioqueue_error; } #if defined(BUF_TRACKING) || defined(FULL_BUF_TRACKING) if (ccb->ccb_h.func_code == XPT_SCSI_IO) ccb->csio.bio = NULL; #endif + if (ccb->ccb_h.flags & CAM_UNLOCKED) { + error = EINVAL; + goto camioqueue_error; + } + if (ccb->ccb_h.flags & CAM_CDB_POINTER) { if (ccb->csio.cdb_len > IOCDBLEN) { error = EINVAL; - break; + goto camioqueue_error; } error = copyin(ccb->csio.cdb_io.cdb_ptr, ccb->csio.cdb_io.cdb_bytes, ccb->csio.cdb_len); - if (error) - break; + if (error != 0) + goto camioqueue_error; ccb->ccb_h.flags &= ~CAM_CDB_POINTER; } @@ -1904,10 +1912,8 @@ passdoioctl(struct cdev *dev, u_long cmd xpt_print(periph->path, "CCB function code %#x is " "restricted to the XPT device\n", ccb->ccb_h.func_code); - uma_zfree(softc->pass_zone, io_req); - cam_periph_lock(periph); error = ENODEV; - break; + goto camioqueue_error; } /* @@ -1953,11 +1959,8 @@ passdoioctl(struct cdev *dev, u_long cmd || (fc == XPT_SMP_IO) || (fc == XPT_DEV_MATCH) || (fc == XPT_DEV_ADVINFO)) { error = passmemsetup(periph, io_req); - if (error != 0) { - uma_zfree(softc->pass_zone, io_req); - cam_periph_lock(periph); - break; - } + if (error != 0) + goto camioqueue_error; } else io_req->mapinfo.num_bufs_used = 0; @@ -2002,6 +2005,11 @@ passdoioctl(struct cdev *dev, u_long cmd TAILQ_INSERT_TAIL(&softc->done_queue, io_req, links); } break; + +camioqueue_error: + uma_zfree(softc->pass_zone, io_req); + cam_periph_lock(periph); + break; } case CAMIOGET: {