Skip site navigation (1)Skip section navigation (2) 
Date:      Mon, 13 Apr 2020 21:04:34 +0000 (UTC)
From:      Warner Losh <imp@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org
Subject:   svn commit: r359902 - head/sys/cam/scsi
Message-ID:  <202004132104.03DL4Yir066770@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: imp
Date: Mon Apr 13 21:04:33 2020
New Revision: 359902
URL: https://svnweb.freebsd.org/changeset/base/359902

Log:
  Checks here against useracc are not useful and are racy.
  
  copyin/copyout are sufficient to guard against bad addresses. They will return
  EFAULT if the user is up to no good (by choice or ignorance). There's no point
  in checking, since it doesn't even improve the error messages.
  
  Noticed by: jhb
  Reviewed by: brooks, jhb

Modified:
  head/sys/cam/scsi/scsi_pass.c

Modified: head/sys/cam/scsi/scsi_pass.c
==============================================================================
--- head/sys/cam/scsi/scsi_pass.c	Mon Apr 13 21:03:30 2020	(r359901)
+++ head/sys/cam/scsi/scsi_pass.c	Mon Apr 13 21:04:33 2020	(r359902)
@@ -1232,15 +1232,6 @@ passcopysglist(struct cam_periph *periph, struct pass_
 		user_watermark += len_to_copy;
 		kern_watermark += len_to_copy;
 
-		if (!useracc(user_ptr, len_to_copy,
-		    (direction == CAM_DIR_IN) ? VM_PROT_WRITE : VM_PROT_READ)) {
-			xpt_print(periph->path, "%s: unable to access user "
-				  "S/G list element %p len %zu\n", __func__,
-				  user_ptr, len_to_copy);
-			error = EFAULT;
-			goto bailout;
-		}
-
 		if (direction == CAM_DIR_IN) {
 			error = copyout(kern_ptr, user_ptr, len_to_copy);
 			if (error != 0) {
@@ -1445,20 +1436,6 @@ passmemsetup(struct cam_periph *periph, struct pass_io
 			if (io_req->lengths[i] == 0)
 				continue;
 
-			/*
-			 * Make sure that the user's buffer is accessible
-			 * to that process.
-			 */
-			if (!useracc(io_req->user_bufs[i], io_req->lengths[i],
-			    (io_req->dirs[i] == CAM_DIR_IN) ? VM_PROT_WRITE :
-			     VM_PROT_READ)) {
-				xpt_print(periph->path, "%s: user address %p "
-				    "length %u is not accessible\n", __func__,
-				    io_req->user_bufs[i], io_req->lengths[i]);
-				error = EFAULT;
-				goto bailout;
-			}
-
 			tmp_buf = malloc(lengths[i], M_SCSIPASS,
 					 M_WAITOK | M_ZERO);
 			io_req->kern_bufs[i] = tmp_buf;
@@ -1560,13 +1537,6 @@ passmemsetup(struct cam_periph *periph, struct pass_io
 			io_req->flags |= PASS_IO_USER_SEG_MALLOC;
 		} else
 			io_req->user_segptr = io_req->user_segs;
-
-		if (!useracc(*data_ptrs[0], sg_length, VM_PROT_READ)) {
-			xpt_print(periph->path, "%s: unable to access user "
-				  "S/G list at %p\n", __func__, *data_ptrs[0]);
-			error = EFAULT;
-			goto bailout;
-		}
 
 		error = copyin(*data_ptrs[0], io_req->user_segptr, sg_length);
 		if (error != 0) {

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202004132104.03DL4Yir066770>