Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b3dc1a21 authored by Tomas Henzl's avatar Tomas Henzl Committed by James Bottomley
Browse files

[SCSI] megaraid_sas: fix for 32bit apps 

It looks like this patch -

commit 7b2519af
Author: Yang, Bo <Bo.Yang@lsi.com>
Date:   Tue Oct 6 14:52:20 2009 -0600

    [SCSI] megaraid_sas: fix 64 bit sense pointer truncation

has caused a problem for 32bit programs with 64bit os -

http://bugzilla.kernel.org/show_bug.cgi?id=15001



fix by converting the user space 32bit pointer to a 64 bit one when
needed.

[jejb: fix up some 64 bit warnings]
Signed-off-by: default avatarTomas Henzl <thenzl@redhat.com>
Cc: Bo Yang <Bo.Yang@lsi.com>
Signed-off-by: default avatarJames Bottomley <James.Bottomley@suse.de>
parent 6409ea65

drivers/scsi/megaraid/megaraid_sas.c

+16 −2
Original line number Diff line number Diff line
@@ -3781,6 +3781,7 @@ static int megasas_mgmt_compat_ioctl_fw(struct file *file, unsigned long arg) 
	    compat_alloc_user_space(sizeof(struct megasas_iocpacket));

	int i;

	int error = 0;

	compat_uptr_t ptr;



	if (clear_user(ioc, sizeof(*ioc)))

		return -EFAULT;
@@ -3793,9 +3794,22 @@ static int megasas_mgmt_compat_ioctl_fw(struct file *file, unsigned long arg) 
	    copy_in_user(&ioc->sge_count, &cioc->sge_count, sizeof(u32)))

		return -EFAULT;



	for (i = 0; i < MAX_IOCTL_SGE; i++) {

		compat_uptr_t ptr;

	/*

	 * The sense_ptr is used in megasas_mgmt_fw_ioctl only when

	 * sense_len is not null, so prepare the 64bit value under

	 * the same condition.

	 */

	if (ioc->sense_len) {

		void __user **sense_ioc_ptr =

			(void __user **)(ioc->frame.raw + ioc->sense_off);

		compat_uptr_t *sense_cioc_ptr =

			(compat_uptr_t *)(cioc->frame.raw + cioc->sense_off);

		if (get_user(ptr, sense_cioc_ptr) ||

		    put_user(compat_ptr(ptr), sense_ioc_ptr))

			return -EFAULT;

	}



	for (i = 0; i < MAX_IOCTL_SGE; i++) {

		if (get_user(ptr, &cioc->sgl[i].iov_base) ||

		    put_user(compat_ptr(ptr), &ioc->sgl[i].iov_base) ||

		    copy_in_user(&ioc->sgl[i].iov_len,