On Fri, Dec 23, 2016 at 2:00 AM, Christoph Hellwig <h...@lst.de> wrote:
>
> From: Christoph Hellwig <h...@lst.de>
> Date: Fri, 23 Dec 2016 10:57:06 +0100
> Subject: virtio_blk: avoid DMA to stack for the sense buffer
>
> Most users of BLOCK_PC requests allocate the sense buffer on the stack,
> so to avoid DMA to the stack copy them to a field in the heap allocated
> virtblk_req structure. Without that any attempt at SCSI passthrough I/O,
> including the SG_IO ioctl from userspace will crash the kernel. Note that
> this includes running tools like hdparm even when the host does not have
> SCSI passthrough enabled.
Ugh. This patch is nasty.
I think we should just fix blk_execute_rq() instead.
But from a quick look, we also have at least sg_scsi_ioctl() and
sg_io() doing the same thing.
And the SG_IO thing in bsg_ioctl(). And spi_execute() in scsi_transport_spi.c
And resp_requests() in scsi_debug.c.
So I guess ugly it may need to be, and the rule is that the sense
buffer really can be on the stack and you can't DMA to/from it.
Comments from others?
Linus
