VServer 1.9.2 (patch-2.6.8.1-vs1.9.2.diff)

[linux-2.6.git] / drivers / block / scsi_ioctl.c

diff --git a/drivers/block/scsi_ioctl.c b/drivers/block/scsi_ioctl.c
index 93ebb68..41d0239 100644 (file)
--- a/drivers/block/scsi_ioctl.c
+++ b/drivers/block/scsi_ioctl.c
@@ -90,7 +90,7 @@ static int sg_set_reserved_size(request_queue_t *q, int __user *p)
        if (size < 0)
                return -EINVAL;
        if (size > (q->max_sectors << 9))
-               return -EINVAL;
+               size = q->max_sectors << 9;
 
        q->sg_reserved_size = size;
        return 0;
@@ -105,8 +105,80 @@ static int sg_emulated_host(request_queue_t *q, int __user *p)
        return put_user(1, p);
 }
 
-static int sg_io(request_queue_t *q, struct gendisk *bd_disk,
-                struct sg_io_hdr *hdr)
+#define CMD_READ_SAFE  0x01
+#define CMD_WRITE_SAFE 0x02
+#define safe_for_read(cmd)     [cmd] = CMD_READ_SAFE
+#define safe_for_write(cmd)    [cmd] = CMD_WRITE_SAFE
+
+static int verify_command(struct file *file, unsigned char *cmd)
+{
+       static const unsigned char cmd_type[256] = {
+
+               /* Basic read-only commands */
+               safe_for_read(TEST_UNIT_READY),
+               safe_for_read(REQUEST_SENSE),
+               safe_for_read(READ_6),
+               safe_for_read(READ_10),
+               safe_for_read(READ_12),
+               safe_for_read(READ_16),
+               safe_for_read(READ_BUFFER),
+               safe_for_read(READ_LONG),
+               safe_for_read(INQUIRY),
+               safe_for_read(MODE_SENSE),
+               safe_for_read(MODE_SENSE_10),
+               safe_for_read(START_STOP),
+
+               /* Audio CD commands */
+               safe_for_read(GPCMD_PLAY_CD),
+               safe_for_read(GPCMD_PLAY_AUDIO_10),
+               safe_for_read(GPCMD_PLAY_AUDIO_MSF),
+               safe_for_read(GPCMD_PLAY_AUDIO_TI),
+
+               /* CD/DVD data reading */
+               safe_for_read(GPCMD_READ_CD),
+               safe_for_read(GPCMD_READ_CD_MSF),
+               safe_for_read(GPCMD_READ_DISC_INFO),
+               safe_for_read(GPCMD_READ_CDVD_CAPACITY),
+               safe_for_read(GPCMD_READ_DVD_STRUCTURE),
+               safe_for_read(GPCMD_READ_HEADER),
+               safe_for_read(GPCMD_READ_TRACK_RZONE_INFO),
+               safe_for_read(GPCMD_READ_SUBCHANNEL),
+               safe_for_read(GPCMD_READ_TOC_PMA_ATIP),
+               safe_for_read(GPCMD_REPORT_KEY),
+               safe_for_read(GPCMD_SCAN),
+
+               /* Basic writing commands */
+               safe_for_write(WRITE_6),
+               safe_for_write(WRITE_10),
+               safe_for_write(WRITE_VERIFY),
+               safe_for_write(WRITE_12),
+               safe_for_write(WRITE_VERIFY_12),
+               safe_for_write(WRITE_16),
+               safe_for_write(WRITE_BUFFER),
+               safe_for_write(WRITE_LONG),
+       };
+       unsigned char type = cmd_type[cmd[0]];
+
+       /* Anybody who can open the device can do a read-safe command */
+       if (type & CMD_READ_SAFE)
+               return 0;
+
+       /* Write-safe commands just require a writable open.. */
+       if (type & CMD_WRITE_SAFE) {
+               if (file->f_mode & FMODE_WRITE)
+                       return 0;
+       }
+
+       /* And root can do any command.. */
+       if (capable(CAP_SYS_RAWIO))
+               return 0;
+
+       /* Otherwise fail it with an "Operation not permitted" */
+       return -EPERM;
+}
+
+static int sg_io(struct file *file, request_queue_t *q,
+               struct gendisk *bd_disk, struct sg_io_hdr *hdr)
 {
        unsigned long start_time;
        int reading, writing;
@@ -121,6 +193,8 @@ static int sg_io(request_queue_t *q, struct gendisk *bd_disk,
                return -EINVAL;
        if (copy_from_user(cmd, hdr->cmdp, hdr->cmd_len))
                return -EFAULT;
+       if (verify_command(file, cmd))
+               return -EPERM;
 
        /*
         * we'll do that later
@@ -170,6 +244,13 @@ static int sg_io(request_queue_t *q, struct gendisk *bd_disk,
        rq->flags |= REQ_BLOCK_PC;
        bio = rq->bio;
 
+       /*
+        * bounce this after holding a reference to the original bio, it's
+        * needed for proper unmapping
+        */
+       if (rq->bio)
+               blk_queue_bounce(q, &rq->bio);
+
        rq->timeout = (hdr->timeout * HZ) / 1000;
        if (!rq->timeout)
                rq->timeout = q->sg_timeout;
@@ -204,7 +285,7 @@ static int sg_io(request_queue_t *q, struct gendisk *bd_disk,
                        hdr->sb_len_wr = len;
        }
 
-       if (blk_rq_unmap_user(rq, hdr->dxferp, bio, hdr->dxfer_len))
+       if (blk_rq_unmap_user(rq, bio, hdr->dxfer_len))
                return -EFAULT;
 
        /* may not have succeeded, but output values written to control
@@ -219,8 +300,8 @@ static int sg_io(request_queue_t *q, struct gendisk *bd_disk,
 #define READ_DEFECT_DATA_TIMEOUT       (60 * HZ )
 #define OMAX_SB_LEN 16          /* For backward compatibility */
 
-static int sg_scsi_ioctl(request_queue_t *q, struct gendisk *bd_disk,
-                        Scsi_Ioctl_Command __user *sic)
+static int sg_scsi_ioctl(struct file *file, request_queue_t *q,
+                        struct gendisk *bd_disk, Scsi_Ioctl_Command __user *sic)
 {
        struct request *rq;
        int err, in_len, out_len, bytes, opcode, cmdlen;
@@ -262,6 +343,10 @@ static int sg_scsi_ioctl(request_queue_t *q, struct gendisk *bd_disk,
        if (copy_from_user(buffer, sic->data + cmdlen, in_len))
                goto error;
 
+       err = verify_command(file, rq->cmd);
+       if (err)
+               goto error;
+
        switch (opcode) {
                case SEND_DIAGNOSTIC:
                case FORMAT_UNIT:
@@ -312,7 +397,7 @@ error:
        return err;
 }
 
-int scsi_cmd_ioctl(struct gendisk *bd_disk, unsigned int cmd, void __user *arg)
+int scsi_cmd_ioctl(struct file *file, struct gendisk *bd_disk, unsigned int cmd, void __user *arg)
 {
        request_queue_t *q;
        struct request *rq;
@@ -359,7 +444,7 @@ int scsi_cmd_ioctl(struct gendisk *bd_disk, unsigned int cmd, void __user *arg)
                        err = -EFAULT;
                        if (copy_from_user(&hdr, arg, sizeof(hdr)))
                                break;
-                       err = sg_io(q, bd_disk, &hdr);
+                       err = sg_io(file, q, bd_disk, &hdr);
                        if (err == -EFAULT)
                                break;
 
@@ -407,7 +492,7 @@ int scsi_cmd_ioctl(struct gendisk *bd_disk, unsigned int cmd, void __user *arg)
                        hdr.cmdp = ((struct cdrom_generic_command __user*) arg)->cmd;
                        hdr.cmd_len = sizeof(cgc.cmd);
 
-                       err = sg_io(q, bd_disk, &hdr);
+                       err = sg_io(file, q, bd_disk, &hdr);
                        if (err == -EFAULT)
                                break;
 
@@ -430,7 +515,7 @@ int scsi_cmd_ioctl(struct gendisk *bd_disk, unsigned int cmd, void __user *arg)
                        if (!arg)
                                break;
 
-                       err = sg_scsi_ioctl(q, bd_disk, arg);
+                       err = sg_scsi_ioctl(file, q, bd_disk, arg);
                        break;
                case CDROMCLOSETRAY:
                        close = 1;