linux-kernel - [PATCH 3.12 29/76] scsi: Avoid crashing if device uses DIX but adapter does not support it

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 19 May 2016 11:07:51 +0200
From:	Jiri Slaby <jslaby@...e.cz>
To:	stable@...r.kernel.org
Cc:	linux-kernel@...r.kernel.org, "Ewan D. Milne" <emilne@...hat.com>,
	Christoph Hellwig <hch@....de>, Jiri Slaby <jslaby@...e.cz>
Subject: [PATCH 3.12 29/76] scsi: Avoid crashing if device uses DIX but adapter does not support it

From: "Ewan D. Milne" <emilne@...hat.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 91724c20613484555ba7e7b3d8549dac1e24f7a8 upstream.

This can happen if a multipathed device uses DIX and another path is
added via an adapter that does not support it.  Multipath should not
allow this path to be added, but we should not depend upon that to avoid
crashing.

Signed-off-by: Ewan D. Milne <emilne@...hat.com>
Reviewed-by: Martin K. Petersen <martin.petersen@...cle.com>
Signed-off-by: Christoph Hellwig <hch@....de>
Signed-off-by: Jiri Slaby <jslaby@...e.cz>
---
 drivers/scsi/scsi_lib.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 0c6a2660d1d5..2b01c88ad416 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1096,7 +1096,17 @@ int scsi_init_io(struct scsi_cmnd *cmd, gfp_t gfp_mask)
 		struct scsi_data_buffer *prot_sdb = cmd->prot_sdb;
 		int ivecs, count;
 
-		BUG_ON(prot_sdb == NULL);
+		if (prot_sdb == NULL) {
+			/*
+			 * This can happen if someone (e.g. multipath)
+			 * queues a command to a device on an adapter
+			 * that does not support DIX.
+			 */
+			WARN_ON_ONCE(1);
+			error = BLKPREP_KILL;
+			goto err_exit;
+		}
+
 		ivecs = blk_rq_count_integrity_sg(rq->q, rq->bio);
 
 		if (scsi_alloc_sgtable(prot_sdb, ivecs, gfp_mask)) {
-- 
2.8.2