linux-kernel - Re: [PATCH]: Fix old SCSI adapter crashes with CD-ROM (take 2)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20070508171519.GG4163@kernel.dk>
Date:	Tue, 8 May 2007 19:15:19 +0200
From:	Jens Axboe <jens.axboe@...cle.com>
To:	James Bottomley <James.Bottomley@...elEye.com>
Cc:	Alan Cox <alan@...rguk.ukuu.org.uk>, linux-scsi@...r.kernel.org,
	akpm@...l.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH]: Fix old SCSI adapter crashes with CD-ROM (take 2)

On Tue, May 08 2007, James Bottomley wrote:
> On Tue, 2007-05-08 at 18:40 +0200, Jens Axboe wrote:
> > On Tue, May 08 2007, James Bottomley wrote:
> > > On Tue, 2007-05-08 at 18:14 +0200, Jens Axboe wrote:
> > > > On Tue, May 08 2007, Alan Cox wrote:
> > > > > The CD-ROM layer doesn't bounce requests for old ISA controllers (and
> > > > > nor should it). However they get injected into the SCSI layer via
> > > > > sr_ioctl which also doesn't bounce them and SCSI then passes the buffer
> > > > > along to a device with unchecked_isa_dma set which either panics or
> > > > > truncates the buffer to 24bits.
> > > > > 
> > > > > According to Jens the right long term fix is for the CD layer to route
> > > > > the requests differently but in the mean time this has been tested by a
> > > > > victim and verified to sort the problem out. For the other 99.9% of users
> > > > > it's a no-op and doesn't bounce data.
> > > > > 
> > > > > Signed-off-by: Alan Cox <alan@...hat.com>
> > > > 
> > > > Signed-off-by: Jens Axboe <jens.axboe@...cle.com>
> > > > 
> > > > Christoph passed me his patch to get rid of ->generic_packet() in the
> > > > cdrom layer, so the work is almost complete. This patch is fine as a
> > > > work-around until that gets merged, though.
> > > 
> > > Actually, I think the new scsi request infrastructure should be doing
> > > the bouncing (rather than have it done in each problem path we
> > > discover).
> > 
> > Of course, bouncing should only be done in one layer (the block layer).
> > >
> > > Mike Christie tells me we're missing bouncing by accident in the
> > > scsi_execute path (but not the scsi_execute_async path).  He says this
> > > is the fix he proposed:
> > > 
> > > http://marc.info/?l=linux-scsi&m=115981479822790&w=2
> > > 
> > > Can we just merge this instead?
> > 
> > That's another issue. The problem here are requests (cgc's) initiated by
> > the cdrom.c layer. Those _should_ get mapped to a request and put on the
> > queue for the device, and thus get bounced by the block layer if
> > appropriate.
> > 
> > Mike's fix looks legit and should be merged as well, but it wont fix
> > this issue.
> 
> It won't?  I thought the issue (from the fix) is that cgc->buffer is
> outside of the device accessibility mask.  The scsi_execute path
> allocates a request and then calls blk_rq_map_kern on the buffer (in
> this case cgc->buffer) ... the problem is that blk_rq_map_kern() doesn't
> currently bounce the buffer, but if it did (which is the functionality
> Mike's patch adds), surely the need to bounce it in the ioctl path would
> go away?

You are right, I missed that scsi_execute() actually builds a request in
the proper manner.

Mikes patch is in the for-2.6.22 block branch and I asked Linus to pull,
so all should be well.

-- 
Jens Axboe

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/