Al Viro e30250c95b sg_write()/bsg_write() is not fit to be called under KERNEL_DS ...

commit a0ac402cfc upstream.

Both damn things interpret userland pointers embedded into the payload;
worse, they are actually traversing those.  Leaving aside the bad
API design, this is very much _not_ safe to call with KERNEL_DS.
Bail out early if that happens.

Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

2017-02-23 03:51:06 +00:00

..

blk-cgroup.c

…

blk-cgroup.h

…

blk-core.c

blktrace: fix accounting of partially completed requests

2014-04-30 16:23:20 +01:00

blk-exec.c

block: Don't access request after it might be freed

2012-12-06 11:20:35 +00:00

blk-flush.c

…

blk-integrity.c

…

blk-ioc.c

…

blk-iopoll.c

…

blk-lib.c

block: add cond_resched() to potentially long running ioctl discard loop

2014-04-02 00:58:51 +01:00

blk-map.c

…

blk-merge.c

…

blk-settings.c

block: fix alignment_offset math that assumes io_min is a power-of-2

2014-12-14 16:23:47 +00:00

blk-softirq.c

…

blk-sysfs.c

block: avoid using uninitialized value in from queue_var_store

2013-04-25 20:25:47 +01:00

blk-tag.c

block: don't assume last put of shared tags is for the host

2014-09-13 23:41:37 +01:00

blk-throttle.c

block: add blk_queue_dead()

2012-08-02 14:37:54 +01:00

blk-timeout.c

block: fix race between request completion and timeout handling

2014-01-03 04:33:18 +00:00

blk.h

block: add blk_queue_dead()

2012-08-02 14:37:54 +01:00

bsg-lib.c

…

bsg.c

sg_write()/bsg_write() is not fit to be called under KERNEL_DS

2017-02-23 03:51:06 +00:00

cfq-iosched.c

…

cfq.h

…

compat_ioctl.c

…

deadline-iosched.c

…

elevator.c

…

genhd.c

block: fix use-after-free in seq file

2016-11-20 01:01:30 +00:00

ioctl.c

…

Kconfig

…

Kconfig.iosched

…

Makefile

…

noop-iosched.c

…

scsi_ioctl.c

scsi: Fix error handling in SCSI_IOCTL_SEND_COMMAND

2014-12-14 16:23:50 +00:00