scst: Make it possible for scst_user to copy sense data to user space

This patch avoids that the following call trace is reported with usercopy
hardening enabled:

Bad or missing usercopy whitelist? Kernel memory overwrite attempt detected to SLUB object 'pool_workqueue' (offset 0, size 28)!
WARNING: CPU: 3 PID: 26167 at mm/usercopy.c:81 usercopy_warn+0x7d/0xa0
Modules linked in: ch osst st scst_user(OE) scst_tape(OE) scst_local(OE) scst_changer(OE) isert_scst(OE) iscsi_scst(OE) scst(OE) dlm rdma_cm iw_cm ib_cm ib_core libcrc32c virtio_balloon joydev i2c_piix4 qxl drm_kms_helper ttm drm virtio_net ata_generic virtio_blk serio_raw net_failover failover pata_acpi
CPU: 3 PID: 26167 Comm: ctdevice Tainted: G           OE     4.18.16-300.fc29.x86_64 #1
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
Call Trace:
 __check_object_size+0x145/0x171
 dev_user_process_reply+0xaab/0xc20 [scst_user]
 dev_user_ioctl+0x4f5/0x8eb [scst_user]
 do_vfs_ioctl+0xa4/0x620
 ksys_ioctl+0x60/0x90
 __x64_sys_ioctl+0x16/0x20
 do_syscall_64+0x5b/0x160
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

This was reported by Rob Turk.


git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@7797 d57e44dd-8a1f-0410-8b47-8ef2f437770f
This commit is contained in:
Bart Van Assche
2018-11-06 02:30:55 +00:00
parent ca512bf87c
commit 97aadf7b99
+8 -1
View File
@@ -2579,6 +2579,13 @@ static int __init init_scst(void)
(p); \
})
#define INIT_CACHEP_USERCOPY(p, s, f) ({ \
(p) = KMEM_CACHE_USERCOPY(s, SCST_SLAB_FLAGS, f); \
TRACE_MEM("Slab create: %s at %p size %zd", #s, (p), \
sizeof(struct s)); \
(p); \
})
/* Used for structures with fast path write access */
#define INIT_CACHEP_ALIGN(p, s) ({ \
(p) = KMEM_CACHE(s, SCST_SLAB_FLAGS|SLAB_HWCACHE_ALIGN);\
@@ -2603,7 +2610,7 @@ static int __init init_scst(void)
goto out_destroy_mgmt_stub_cache;
{
struct scst_sense { uint8_t s[SCST_SENSE_BUFFERSIZE]; };
if (!INIT_CACHEP(scst_sense_cachep, scst_sense))
if (!INIT_CACHEP_USERCOPY(scst_sense_cachep, scst_sense, s))
goto out_destroy_ua_cache;
}
if (!INIT_CACHEP(scst_aen_cachep, scst_aen)) /* read-mostly */