Re: [PATCH] sg: fix a double-fetch bug in sg_write()

2019-06-06 Thread Gen Zhang
On Thu, Jun 06, 2019 at 07:01:26AM +0200, Jiri Slaby wrote: > On 05. 06. 19, 17:35, Gen Zhang wrote: > > On Wed, Jun 05, 2019 at 08:41:11AM +0200, Jiri Slaby wrote: > >> On 31. 05. 19, 3:27, Gen Zhang wrote: > >>> In sg_write(), the opcode of the command is fetched the first time from > >>> the us

Re: [PATCH] sg: fix a double-fetch bug in sg_write()

2019-06-05 Thread Jiri Slaby
On 05. 06. 19, 17:35, Gen Zhang wrote: > On Wed, Jun 05, 2019 at 08:41:11AM +0200, Jiri Slaby wrote: >> On 31. 05. 19, 3:27, Gen Zhang wrote: >>> In sg_write(), the opcode of the command is fetched the first time from >>> the userspace by __get_user(). Then the whole command, the opcode >>> inclu

Re: [PATCH] sg: fix a double-fetch bug in sg_write()

2019-06-05 Thread Gen Zhang
On Wed, Jun 05, 2019 at 08:41:11AM +0200, Jiri Slaby wrote: > On 31. 05. 19, 3:27, Gen Zhang wrote: > > In sg_write(), the opcode of the command is fetched the first time from > > the userspace by __get_user(). Then the whole command, the opcode > > included, is fetched again from userspace by __

Re: [PATCH] sg: fix a double-fetch bug in sg_write()

2019-06-04 Thread Jiri Slaby
On 31. 05. 19, 3:27, Gen Zhang wrote: > In sg_write(), the opcode of the command is fetched the first time from > the userspace by __get_user(). Then the whole command, the opcode > included, is fetched again from userspace by __copy_from_user(). > However, a malicious user can change the opcode

[PATCH] sg: fix a double-fetch bug in sg_write()

2019-05-30 Thread Gen Zhang
In sg_write(), the opcode of the command is fetched the first time from the userspace by __get_user(). Then the whole command, the opcode included, is fetched again from userspace by __copy_from_user(). However, a malicious user can change the opcode between the two fetches. This can cause incon

[PATCH] sg: fix a double-fetch bug in sg_write()

2019-05-26 Thread Gen Zhang
In sg_write(), the opcode of the command is fetched the first time from the userspace by __get_user(). Then the whole command, the opcode included, is fetched again from userspace by __copy_from_user(). However, a malicious user can change the opcode between the two fetches. This can cause incon