Hi all, the infamous syzkaller incovered some more issues in the sg driver. This patchset fixes those two issues (and adds a fix for yet another potential issue; checking for a NULL dxferp when dxfer_len is not 0). It also removes handling of the SET_FORCE_LOW_DMA ioctl, which never worked since the initial git checkin. And does some code cleanup by removing the private list implementation, using standard lists instead.
As usual, comments and reviews are welcome. Changes to v1: - Include reviews from Christoph - Add patch to close race condition in sg_remove_sfp_usercontext() - Remove stale variable 'save_scat_len' Changes to v2: - Move misplaced hunk - Add Reviewed-by: and Tested-by: tags Changes to v3: - Review locking in 'sg: protect accesses ...' - Reshuffle hunks to keep kbuild robot happy Hannes Reinecke (5): sg: disable SET_FORCE_LOW_DMA sg: remove 'save_scat_len' sg: protect accesses to 'reserved' page array sg: use standard lists for sg_requests sg: close race condition in sg_remove_sfp_usercontext() Johannes Thumshirn (1): sg: check for valid direction before starting the request drivers/scsi/sg.c | 282 +++++++++++++++++++++++++++--------------------------- include/scsi/sg.h | 1 - 2 files changed, 139 insertions(+), 144 deletions(-) -- 1.8.5.6
