linux-kernel - Re: [PATCH v2 17/27] compat_ioctl: ide: floppy: add handler

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAK8P3a3QGa-U_-G6n1A=aFpci5GHksP_t+x8yLLAjOtB2WcqYA@mail.gmail.com>
Date:   Wed, 18 Dec 2019 20:28:20 +0100
From:   Arnd Bergmann <arnd@...db.de>
To:     Ben Hutchings <ben.hutchings@...ethink.co.uk>
Cc:     Jens Axboe <axboe@...nel.dk>,
        "James E.J. Bottomley" <jejb@...ux.ibm.com>,
        "Martin K. Petersen" <martin.petersen@...cle.com>,
        linux-scsi <linux-scsi@...r.kernel.org>,
        linux-block <linux-block@...r.kernel.org>,
        y2038 Mailman List <y2038@...ts.linaro.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Christoph Hellwig <hch@....de>,
        "open list:DOCUMENTATION" <linux-doc@...r.kernel.org>,
        Jonathan Corbet <corbet@....net>,
        Al Viro <viro@...iv.linux.org.uk>,
        Linux FS-devel Mailing List <linux-fsdevel@...r.kernel.org>
Subject: Re: [PATCH v2 17/27] compat_ioctl: ide: floppy: add handler

On Wed, Dec 18, 2019 at 7:45 PM Ben Hutchings
<ben.hutchings@...ethink.co.uk> wrote:
>
> On Tue, 2019-12-17 at 23:16 +0100, Arnd Bergmann wrote:
> > Rather than relying on fs/compat_ioctl.c, this adds support
> > for a compat_ioctl() callback in the ide-floppy driver directly,
> > which lets it translate the scsi commands.
> [...]
>
> After this, and before "compat_ioctl: move HDIO ioctl handling into
> drivers/ide", compat ioctls on an IDE hard drive will result in a null
> pointer dereference in ide_gd_compat_ioctl().  Not sure how much that
> really matters though.

I'm sure it makes no difference in the end, but you are of course right that
this is a bug. I've folded in a check now, and leaving that in place
even after it is no longer needed:

--- a/drivers/ide/ide-gd.c
+++ b/drivers/ide/ide-gd.c
@@ -348,6 +348,9 @@ static int ide_gd_compat_ioctl(struct block_device
*bdev, fmode_t mode,
        struct ide_disk_obj *idkp = ide_drv_g(bdev->bd_disk, ide_disk_obj);
        ide_drive_t *drive = idkp->drive;

+       if (!drive->disk_ops->compat_ioctl)
+               return -ENOIOCTLCMD;
+
        return drive->disk_ops->compat_ioctl(drive, bdev, mode, cmd, arg);
 }
 #endif

I pushed out an updated signed tag with this change.

Thanks for the continued careful review!

       Arnd