From b9f5cdc4eb0b8c2a3b44a557611c56843f42d13e Mon Sep 17 00:00:00 2001 From: Bart Van Assche Date: Wed, 31 May 2017 14:43:47 -0700 Subject: [PATCH] bsg: Check queue type before attaching to a queue Since BSG only supports request queues for which struct scsi_request is the first member of their private request data, refuse to register block layer queues for which struct scsi_request is not the first member of their private data. References: commit 9225a2f0cf9e ("scsi_transport_sas: fix BSG ioctl memory corruption") References: commit e5e0f7fb06a0 ("block: split scsi_request out of struct request") Signed-off-by: Bart Van Assche Reviewed-by: Hannes Reinecke Reviewed-by: Christoph Hellwig Cc: Omar Sandoval Signed-off-by: Jens Axboe --- block/bsg.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/block/bsg.c b/block/bsg.c index 6fd08544d77ea..40db8ff4c6189 100644 --- a/block/bsg.c +++ b/block/bsg.c @@ -750,6 +750,12 @@ static struct bsg_device *bsg_add_device(struct inode *inode, #ifdef BSG_DEBUG unsigned char buf[32]; #endif + + if (!blk_queue_scsi_passthrough(rq)) { + WARN_ONCE(true, "Attempt to register a non-SCSI queue\n"); + return ERR_PTR(-EINVAL); + } + if (!blk_get_queue(rq)) return ERR_PTR(-ENXIO); -- 2.39.5