From patchwork Tue Jul 31 19:51:53 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 10551249 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id AD91D1822 for ; Tue, 31 Jul 2018 19:52:13 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9E9C72B1A2 for ; Tue, 31 Jul 2018 19:52:13 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 9133C2B4EE; Tue, 31 Jul 2018 19:52:13 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 34CE62B1A2 for ; Tue, 31 Jul 2018 19:52:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732577AbeGaVeE (ORCPT ); Tue, 31 Jul 2018 17:34:04 -0400 Received: from mail-pf1-f194.google.com ([209.85.210.194]:34280 "EHLO mail-pf1-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732556AbeGaVeD (ORCPT ); Tue, 31 Jul 2018 17:34:03 -0400 Received: by mail-pf1-f194.google.com with SMTP id k19-v6so6607376pfi.1 for ; Tue, 31 Jul 2018 12:52:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=E44b1UBlsj2/IHAbzBckjiuffByHshaDmOrs2Gu2tI4=; b=Wq8RpQQOXsbyRWvbAOvLymq8ygV5dhwb5w1AiIoJ0NMSVIq4+ouSkwu6hGQmxWQhvr mwTZeAexVcv9Npla5vL9s7D1EkVQ0hoOzPkC5PupJnRdpk6AyYHf/2qOuiYKgt1xS49i Fstgr+OVl/UI5EpxJHJAmRt2ftgXqH93ad1qc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=E44b1UBlsj2/IHAbzBckjiuffByHshaDmOrs2Gu2tI4=; b=LzHywDhg82+9pHBdQSSOACkVhcf7YVxrN2hRdxj35gWVyvFCKS9cpDcmgAWRUxmvxG rWq6bToZd1zMzw3GJaoNZBVC7s44fRfiyzyVI4QKYlUCpoORufHVpsyeak+wNkNgGJtw PF0srWzbsncvEtZN/znAGB56L0xSQeSL0lcuDYiHTdq7TqcIDIvqBMsBuIDbB4Qr7kTl Cp78csRezxXpmpy2BEx+gpE7T5UPVueyZHKbVoYsYIwm5/2s5WFwoepaptXYpP1tJ5NL GeZA3w+VfmA9EtDWXfXiQyBRud09CDKmqmMxohP9F2IDmmLufp7Ms1/vGVLdLG4+1RtI /KpA== X-Gm-Message-State: AOUpUlG39KTwN/leTqrgunvvXOsBlsX602yLBCZ8gWUhdiGl23fa6RBO 7YvVn+mZNmSFOdGT+vDC/19uVg== X-Google-Smtp-Source: AAOMgpfoqWUqSKi64N6kyTOW2ld18UOH7YkZ1F6YlqQaU9eFa6C7Kovb5ksb3L/QNoK3gcIdM2XHQg== X-Received: by 2002:a62:858c:: with SMTP id m12-v6mr23630798pfk.173.1533066730092; Tue, 31 Jul 2018 12:52:10 -0700 (PDT) Received: from www.outflux.net (173-164-112-133-Oregon.hfc.comcastbusiness.net. [173.164.112.133]) by smtp.gmail.com with ESMTPSA id x15-v6sm23735254pgc.46.2018.07.31.12.52.06 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Tue, 31 Jul 2018 12:52:07 -0700 (PDT) From: Kees Cook To: Jens Axboe Cc: Kees Cook , Christoph Hellwig , "Martin K. Petersen" , "James E.J. Bottomley" , Tejun Heo , Borislav Petkov , "David S. Miller" , "Manoj N. Kumar" , "Matthew R. Ochs" , Uma Krishnan , "Nicholas A. Bellinger" , Thomas Gleixner , Philippe Ombredanne , Stephen Boyd , Cyrille Pitchen , Juergen Gross , Viresh Kumar , =?utf-8?q?Uwe_Kleine-K=C3=B6nig?= , Sagar Dharia , Randy Dunlap , Vinod Koul , David Kershner , linux-block@vger.kernel.org, linux-ide@vger.kernel.org, linux-scsi@vger.kernel.org, target-devel@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 8/9] libata-scsi: Move sense buffers onto stack Date: Tue, 31 Jul 2018 12:51:53 -0700 Message-Id: <20180731195155.46664-9-keescook@chromium.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20180731195155.46664-1-keescook@chromium.org> References: <20180731195155.46664-1-keescook@chromium.org> Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP To support future compile-time sizeof() checks that will be able to validate the length of sense buffers, this removes the only dynamically allocated sense buffers in the tree by putting the 96 byte sense buffers on the stack. Signed-off-by: Kees Cook Reviewed-by: Christoph Hellwig Acked-by: Tejun Heo --- drivers/ata/libata-scsi.c | 18 ++++++------------ 1 file changed, 6 insertions(+), 12 deletions(-) diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c index 89a9d4a2efc8..3a43d3a1ce2d 100644 --- a/drivers/ata/libata-scsi.c +++ b/drivers/ata/libata-scsi.c @@ -597,8 +597,9 @@ static int ata_get_identity(struct ata_port *ap, struct scsi_device *sdev, int ata_cmd_ioctl(struct scsi_device *scsidev, void __user *arg) { int rc = 0; + u8 sensebuf[SCSI_SENSE_BUFFERSIZE]; u8 scsi_cmd[MAX_COMMAND_SIZE]; - u8 args[4], *argbuf = NULL, *sensebuf = NULL; + u8 args[4], *argbuf = NULL; int argsize = 0; enum dma_data_direction data_dir; struct scsi_sense_hdr sshdr; @@ -610,10 +611,7 @@ int ata_cmd_ioctl(struct scsi_device *scsidev, void __user *arg) if (copy_from_user(args, arg, sizeof(args))) return -EFAULT; - sensebuf = kzalloc(SCSI_SENSE_BUFFERSIZE, GFP_NOIO); - if (!sensebuf) - return -ENOMEM; - + memset(sensebuf, 0, sizeof(sensebuf)); memset(scsi_cmd, 0, sizeof(scsi_cmd)); if (args[3]) { @@ -685,7 +683,6 @@ int ata_cmd_ioctl(struct scsi_device *scsidev, void __user *arg) && copy_to_user(arg + sizeof(args), argbuf, argsize)) rc = -EFAULT; error: - kfree(sensebuf); kfree(argbuf); return rc; } @@ -704,8 +701,9 @@ int ata_cmd_ioctl(struct scsi_device *scsidev, void __user *arg) int ata_task_ioctl(struct scsi_device *scsidev, void __user *arg) { int rc = 0; + u8 sensebuf[SCSI_SENSE_BUFFERSIZE]; u8 scsi_cmd[MAX_COMMAND_SIZE]; - u8 args[7], *sensebuf = NULL; + u8 args[7]; struct scsi_sense_hdr sshdr; int cmd_result; @@ -715,10 +713,7 @@ int ata_task_ioctl(struct scsi_device *scsidev, void __user *arg) if (copy_from_user(args, arg, sizeof(args))) return -EFAULT; - sensebuf = kzalloc(SCSI_SENSE_BUFFERSIZE, GFP_NOIO); - if (!sensebuf) - return -ENOMEM; - + memset(sensebuf, 0, sizeof(sensebuf)); memset(scsi_cmd, 0, sizeof(scsi_cmd)); scsi_cmd[0] = ATA_16; scsi_cmd[1] = (3 << 1); /* Non-data */ @@ -769,7 +764,6 @@ int ata_task_ioctl(struct scsi_device *scsidev, void __user *arg) } error: - kfree(sensebuf); return rc; }