From 97aadf7b99b25433f24b0015f9bbd39e94527dc1 Mon Sep 17 00:00:00 2001 From: Bart Van Assche Date: Tue, 6 Nov 2018 02:30:55 +0000 Subject: [PATCH] scst: Make it possible for scst_user to copy sense data to user space This patch avoids that the following call trace is reported with usercopy hardening enabled: Bad or missing usercopy whitelist? Kernel memory overwrite attempt detected to SLUB object 'pool_workqueue' (offset 0, size 28)! WARNING: CPU: 3 PID: 26167 at mm/usercopy.c:81 usercopy_warn+0x7d/0xa0 Modules linked in: ch osst st scst_user(OE) scst_tape(OE) scst_local(OE) scst_changer(OE) isert_scst(OE) iscsi_scst(OE) scst(OE) dlm rdma_cm iw_cm ib_cm ib_core libcrc32c virtio_balloon joydev i2c_piix4 qxl drm_kms_helper ttm drm virtio_net ata_generic virtio_blk serio_raw net_failover failover pata_acpi CPU: 3 PID: 26167 Comm: ctdevice Tainted: G OE 4.18.16-300.fc29.x86_64 #1 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Call Trace: __check_object_size+0x145/0x171 dev_user_process_reply+0xaab/0xc20 [scst_user] dev_user_ioctl+0x4f5/0x8eb [scst_user] do_vfs_ioctl+0xa4/0x620 ksys_ioctl+0x60/0x90 __x64_sys_ioctl+0x16/0x20 do_syscall_64+0x5b/0x160 entry_SYSCALL_64_after_hwframe+0x44/0xa9 This was reported by Rob Turk. git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@7797 d57e44dd-8a1f-0410-8b47-8ef2f437770f --- scst/src/scst_main.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/scst/src/scst_main.c b/scst/src/scst_main.c index 8cd0efdf4..f604aca6a 100644 --- a/scst/src/scst_main.c +++ b/scst/src/scst_main.c @@ -2579,6 +2579,13 @@ static int __init init_scst(void) (p); \ }) +#define INIT_CACHEP_USERCOPY(p, s, f) ({ \ + (p) = KMEM_CACHE_USERCOPY(s, SCST_SLAB_FLAGS, f); \ + TRACE_MEM("Slab create: %s at %p size %zd", #s, (p), \ + sizeof(struct s)); \ + (p); \ + }) + /* Used for structures with fast path write access */ #define INIT_CACHEP_ALIGN(p, s) ({ \ (p) = KMEM_CACHE(s, SCST_SLAB_FLAGS|SLAB_HWCACHE_ALIGN);\ @@ -2603,7 +2610,7 @@ static int __init init_scst(void) goto out_destroy_mgmt_stub_cache; { struct scst_sense { uint8_t s[SCST_SENSE_BUFFERSIZE]; }; - if (!INIT_CACHEP(scst_sense_cachep, scst_sense)) + if (!INIT_CACHEP_USERCOPY(scst_sense_cachep, scst_sense, s)) goto out_destroy_ua_cache; } if (!INIT_CACHEP(scst_aen_cachep, scst_aen)) /* read-mostly */