[4.2.y-ckt stable] Patch "megaraid_sas : SMAP restriction--do not access user memory from IOCTL code" has been added to staging queue

[Kamal Mostafa]

This is a note to let you know that I have just added a patch titled

    megaraid_sas : SMAP restriction--do not access user memory from IOCTL code

to the linux-4.2.y-queue branch of the 4.2.y-ckt extended stable tree 
which can be found at:

    http://kernel.ubuntu.com/git/ubuntu/linux.git/log/?h=linux-4.2.y-queue

This patch is scheduled to be released in version 4.2.8-ckt1.

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 4.2.y-ckt tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

>From 3e33cb049396ae27f1d559d7f713eba5b7f8ea53 Mon Sep 17 00:00:00 2001
From: "sumit.saxena at avagotech.com" <sumit.saxena at avagotech.com>
Date: Thu, 15 Oct 2015 13:40:54 +0530
Subject: megaraid_sas : SMAP restriction--do not access user memory from IOCTL
 code

commit 323c4a02c631d00851d8edc4213c4d184ef83647 upstream.

This is an issue on SMAP enabled CPUs and 32 bit apps running on 64 bit
OS. Do not access user memory from kernel code. The SMAP bit restricts
accessing user memory from kernel code.

Signed-off-by: Sumit Saxena <sumit.saxena at avagotech.com>
Signed-off-by: Kashyap Desai <kashyap.desai at avagotech.com>
Reviewed-by: Tomas Henzl <thenzl at redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen at oracle.com>
Signed-off-by: Kamal Mostafa <kamal at canonical.com>
---
 drivers/scsi/megaraid/megaraid_sas_base.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index 00eb416..2ec768b 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -6326,6 +6326,9 @@ static int megasas_mgmt_compat_ioctl_fw(struct file *file, unsigned long arg)
 	int i;
 	int error = 0;
 	compat_uptr_t ptr;
+	unsigned long local_raw_ptr;
+	u32 local_sense_off;
+	u32 local_sense_len;

 	if (clear_user(ioc, sizeof(*ioc)))
 		return -EFAULT;
@@ -6343,9 +6346,15 @@ static int megasas_mgmt_compat_ioctl_fw(struct file *file, unsigned long arg)
 	 * sense_len is not null, so prepare the 64bit value under
 	 * the same condition.
 	 */
-	if (ioc->sense_len) {
+	if (get_user(local_raw_ptr, ioc->frame.raw) ||
+		get_user(local_sense_off, &ioc->sense_off) ||
+		get_user(local_sense_len, &ioc->sense_len))
+		return -EFAULT;
+
+
+	if (local_sense_len) {
 		void __user **sense_ioc_ptr =
-			(void __user **)(ioc->frame.raw + ioc->sense_off);
+			(void __user **)((u8*)local_raw_ptr + local_sense_off);
 		compat_uptr_t *sense_cioc_ptr =
 			(compat_uptr_t *)(cioc->frame.raw + cioc->sense_off);
 		if (get_user(ptr, sense_cioc_ptr) ||
--
1.9.1