Attachment #23859 for bug #60904

View | Details | Raw Unified | Return to bug 60904
Collapse All | Expand All




	return put_user(1, p);
}

#define CMD_READ_SAFE	0x01
#define CMD_WRITE_SAFE	0x02
#define safe_for_read(cmd)	[cmd] = CMD_READ_SAFE
#define safe_for_write(cmd)	[cmd] = CMD_WRITE_SAFE

static int verify_command(struct file *file, unsigned char *cmd)
{
	static const unsigned char cmd_type[256] = {

		/* Basic read-only commands */
		safe_for_read(TEST_UNIT_READY),
		safe_for_read(REQUEST_SENSE),
		safe_for_read(READ_6),
		safe_for_read(READ_10),
		safe_for_read(READ_12),
		safe_for_read(READ_16),
		safe_for_read(READ_BUFFER),
		safe_for_read(READ_LONG),
		safe_for_read(INQUIRY),
		safe_for_read(MODE_SENSE),
		safe_for_read(MODE_SENSE_10),
		safe_for_read(START_STOP),
		safe_for_read(GPCMD_VERIFY_10),
		safe_for_read(VERIFY_16),
		safe_for_read(READ_BUFFER),

		/* Audio CD commands */
		safe_for_read(GPCMD_PLAY_CD),
		safe_for_read(GPCMD_PLAY_AUDIO_10),
		safe_for_read(GPCMD_PLAY_AUDIO_MSF),
		safe_for_read(GPCMD_PLAY_AUDIO_TI),
		safe_for_read(GPCMD_PAUSE_RESUME),

		/* CD/DVD data reading */
		safe_for_read(GPCMD_READ_CD),
		safe_for_read(GPCMD_READ_CD_MSF),
		safe_for_read(GPCMD_READ_DISC_INFO),
		safe_for_read(GPCMD_READ_CDVD_CAPACITY),
		safe_for_read(GPCMD_READ_DVD_STRUCTURE),
		safe_for_read(GPCMD_READ_HEADER),
		safe_for_read(GPCMD_READ_TRACK_RZONE_INFO),
		safe_for_read(GPCMD_READ_SUBCHANNEL),
		safe_for_read(GPCMD_READ_TOC_PMA_ATIP),
		safe_for_read(GPCMD_REPORT_KEY),
		safe_for_read(GPCMD_SCAN),
		safe_for_read(GPCMD_GET_CONFIGURATION),
		safe_for_read(GPCMD_READ_FORMAT_CAPACITIES),
		safe_for_read(GPCMD_GET_EVENT_STATUS_NOTIFICATION),
		safe_for_read(GPCMD_GET_PERFORMANCE),
		safe_for_read(GPCMD_SEEK),
		safe_for_read(GPCMD_STOP_PLAY_SCAN),

		/* Basic writing commands */
		safe_for_write(WRITE_6),
		safe_for_write(WRITE_10),
		safe_for_write(WRITE_VERIFY),
		safe_for_write(WRITE_12),
		safe_for_write(WRITE_VERIFY_12),
		safe_for_write(WRITE_16),
		safe_for_write(WRITE_LONG),
		safe_for_write(ERASE),
		safe_for_write(GPCMD_MODE_SELECT_10),
		safe_for_write(MODE_SELECT),
		safe_for_write(GPCMD_BLANK),
		safe_for_write(GPCMD_CLOSE_TRACK),
		safe_for_write(GPCMD_FLUSH_CACHE),
		safe_for_write(GPCMD_FORMAT_UNIT),
		safe_for_write(GPCMD_REPAIR_RZONE_TRACK),
		safe_for_write(GPCMD_RESERVE_RZONE_TRACK),
		safe_for_write(GPCMD_SEND_DVD_STRUCTURE),
		safe_for_write(GPCMD_SEND_EVENT),
		safe_for_write(GPCMD_SEND_KEY),
		safe_for_write(GPCMD_SEND_OPC),
		safe_for_write(GPCMD_SEND_CUE_SHEET),
		safe_for_write(GPCMD_SET_SPEED),
		safe_for_write(GPCMD_PREVENT_ALLOW_MEDIUM_REMOVAL),
		safe_for_write(GPCMD_LOAD_UNLOAD),
		safe_for_write(GPCMD_SET_STREAMING),
	};
	unsigned char type = cmd_type[cmd[0]];

	/* Anybody who can open the device can do a read-safe command */
	if (type & CMD_READ_SAFE)
		return 0;

	/* Write-safe commands just require a writable open.. */
	if (type & CMD_WRITE_SAFE) {
		if (file->f_mode & FMODE_WRITE)
			return 0;
	}

	/* And root can do any command.. */
	if (capable(CAP_SYS_RAWIO))
		return 0;

	/* Otherwise fail it with an "Operation not permitted" */
	return -EPERM;
}

static int sg_io(struct file *file, request_queue_t *q,
		struct gendisk *bd_disk, struct sg_io_hdr *hdr)
{
	unsigned long start_time;
	int reading, writing;

		return -EINVAL;
	if (hdr->cmd_len > sizeof(rq->cmd))
		return -EINVAL;
	if (verify_command(file, hdr->cmdp))
		return -EPERM;

	/*
	 * we'll do that later


#define OMAX_SB_LEN 16          /* For backward compatibility */

static int sg_scsi_ioctl(struct file *file, request_queue_t *q,
			 struct gendisk *bd_disk, Scsi_Ioctl_Command __user *sic)
{
	struct request *rq;
	int err, in_len, out_len, bytes, opcode, cmdlen;

	if (copy_from_user(buffer, sic->data + cmdlen, in_len))
		goto error;

	err = verify_command(file, rq->cmd);
	if (err)
		goto error;

	switch (opcode) {
		case SEND_DIAGNOSTIC:
		case FORMAT_UNIT:


			old_cdb = hdr.cmdp;
			hdr.cmdp = cdb;
			err = sg_io(file, q, bd_disk, &hdr);
			if (err == -EFAULT)
				break;


			hdr.cmdp = cgc.cmd;
			hdr.cmd_len = sizeof(cgc.cmd);

			err = sg_io(file, q, bd_disk, &hdr);
			if (err == -EFAULT)
				break;


			if (!arg)
				break;

			err = sg_scsi_ioctl(file, q, bd_disk,
					    (Scsi_Ioctl_Command *)arg);
			break;
		case CDROMCLOSETRAY:

Lines 467-475 struct cdrom_generic_command Link Here

(-)/opt/kernel/linux-2.6.5/include/linux/cdrom.h (-1 / +2 lines)
467	#define GPCMD_REPORT_KEY 0xa4	467	#define GPCMD_REPORT_KEY 0xa4
468	#define GPCMD_REQUEST_SENSE 0x03	468	#define GPCMD_REQUEST_SENSE 0x03
469	#define GPCMD_RESERVE_RZONE_TRACK 0x53	469	#define GPCMD_RESERVE_RZONE_TRACK 0x53
		470	#define GPCMD_SEND_CUE_SHEET 0x5d
470	#define GPCMD_SCAN 0xba	471	#define GPCMD_SCAN 0xba
471	#define GPCMD_SEEK 0x2b	472	#define GPCMD_SEEK 0x2b
472	#define GPCMD_SEND_DVD_STRUCTURE 0xad	473	#define GPCMD_SEND_DVD_STRUCTURE 0xbf
473	#define GPCMD_SEND_EVENT 0xa2	474	#define GPCMD_SEND_EVENT 0xa2
474	#define GPCMD_SEND_KEY 0xa3	475	#define GPCMD_SEND_KEY 0xa3
475	#define GPCMD_SEND_OPC 0x54	476	#define GPCMD_SEND_OPC 0x54

Lines 111-116 extern const char *const scsi_device_typ Link Here

(-)/opt/kernel/linux-2.6.5/include/scsi/scsi.h (+1 lines)
111	#define WRITE_LONG_2 0xea	111	#define WRITE_LONG_2 0xea
112	#define READ_16 0x88	112	#define READ_16 0x88
113	#define WRITE_16 0x8a	113	#define WRITE_16 0x8a
		114	#define VERIFY_16 0x8f
114	#define SERVICE_ACTION_IN 0x9e	115	#define SERVICE_ACTION_IN 0x9e
115	/* values for service action in */	116	/* values for service action in */
116	#define SAI_READ_CAPACITY_16 0x10	117	#define SAI_READ_CAPACITY_16 0x10

Return to bug 60904

Lines 105-112 static int sg_emulated_host(request_queu Link Here

(-)/opt/kernel/linux-2.6.5/drivers/block/scsi_ioctl.c (-7 / +112 lines)
105	return put_user(1, p);	105	return put_user(1, p);
106	}	106	}
107		107
108	static int sg_io(request_queue_t q, struct gendisk bd_disk,	108	#define CMD_READ_SAFE 0x01
109	struct sg_io_hdr *hdr)	109	#define CMD_WRITE_SAFE 0x02
		110	#define safe_for_read(cmd) [cmd] = CMD_READ_SAFE
		111	#define safe_for_write(cmd) [cmd] = CMD_WRITE_SAFE
		112
		113	static int verify_command(struct file file, unsigned char cmd)
		114	{
		115	static const unsigned char cmd_type[256] = {
		116
		117	/* Basic read-only commands */
		118	safe_for_read(TEST_UNIT_READY),
		119	safe_for_read(REQUEST_SENSE),
		120	safe_for_read(READ_6),
		121	safe_for_read(READ_10),
		122	safe_for_read(READ_12),
		123	safe_for_read(READ_16),
		124	safe_for_read(READ_BUFFER),
		125	safe_for_read(READ_LONG),
		126	safe_for_read(INQUIRY),
		127	safe_for_read(MODE_SENSE),
		128	safe_for_read(MODE_SENSE_10),
		129	safe_for_read(START_STOP),
		130	safe_for_read(GPCMD_VERIFY_10),
		131	safe_for_read(VERIFY_16),
		132	safe_for_read(READ_BUFFER),
		133
		134	/* Audio CD commands */
		135	safe_for_read(GPCMD_PLAY_CD),
		136	safe_for_read(GPCMD_PLAY_AUDIO_10),
		137	safe_for_read(GPCMD_PLAY_AUDIO_MSF),
		138	safe_for_read(GPCMD_PLAY_AUDIO_TI),
		139	safe_for_read(GPCMD_PAUSE_RESUME),
		140
		141	/* CD/DVD data reading */
		142	safe_for_read(GPCMD_READ_CD),
		143	safe_for_read(GPCMD_READ_CD_MSF),
		144	safe_for_read(GPCMD_READ_DISC_INFO),
		145	safe_for_read(GPCMD_READ_CDVD_CAPACITY),
		146	safe_for_read(GPCMD_READ_DVD_STRUCTURE),
		147	safe_for_read(GPCMD_READ_HEADER),
		148	safe_for_read(GPCMD_READ_TRACK_RZONE_INFO),
		149	safe_for_read(GPCMD_READ_SUBCHANNEL),
		150	safe_for_read(GPCMD_READ_TOC_PMA_ATIP),
		151	safe_for_read(GPCMD_REPORT_KEY),
		152	safe_for_read(GPCMD_SCAN),
		153	safe_for_read(GPCMD_GET_CONFIGURATION),
		154	safe_for_read(GPCMD_READ_FORMAT_CAPACITIES),
		155	safe_for_read(GPCMD_GET_EVENT_STATUS_NOTIFICATION),
		156	safe_for_read(GPCMD_GET_PERFORMANCE),
		157	safe_for_read(GPCMD_SEEK),
		158	safe_for_read(GPCMD_STOP_PLAY_SCAN),
		159
		160	/* Basic writing commands */
		161	safe_for_write(WRITE_6),
		162	safe_for_write(WRITE_10),
		163	safe_for_write(WRITE_VERIFY),
		164	safe_for_write(WRITE_12),
		165	safe_for_write(WRITE_VERIFY_12),
		166	safe_for_write(WRITE_16),
		167	safe_for_write(WRITE_LONG),
		168	safe_for_write(ERASE),
		169	safe_for_write(GPCMD_MODE_SELECT_10),
		170	safe_for_write(MODE_SELECT),
		171	safe_for_write(GPCMD_BLANK),
		172	safe_for_write(GPCMD_CLOSE_TRACK),
		173	safe_for_write(GPCMD_FLUSH_CACHE),
174	safe_for_write(GPCMD_FORMAT_UNIT),
175	safe_for_write(GPCMD_REPAIR_RZONE_TRACK),
176	safe_for_write(GPCMD_RESERVE_RZONE_TRACK),
177	safe_for_write(GPCMD_SEND_DVD_STRUCTURE),
178	safe_for_write(GPCMD_SEND_EVENT),
179	safe_for_write(GPCMD_SEND_KEY),
180	safe_for_write(GPCMD_SEND_OPC),
181	safe_for_write(GPCMD_SEND_CUE_SHEET),
182	safe_for_write(GPCMD_SET_SPEED),
183	safe_for_write(GPCMD_PREVENT_ALLOW_MEDIUM_REMOVAL),
184	safe_for_write(GPCMD_LOAD_UNLOAD),
185	safe_for_write(GPCMD_SET_STREAMING),
186	};
187	unsigned char type = cmd_type[cmd[0]];
188
189	/* Anybody who can open the device can do a read-safe command */
190	if (type & CMD_READ_SAFE)
191	return 0;
192
193	/* Write-safe commands just require a writable open.. */
194	if (type & CMD_WRITE_SAFE) {
195	if (file->f_mode & FMODE_WRITE)
196	return 0;
197	}
198
199	/* And root can do any command.. */
200	if (capable(CAP_SYS_RAWIO))
201	return 0;
202
203	/* Otherwise fail it with an "Operation not permitted" */
204	return -EPERM;
205	}
206
207	static int sg_io(struct file file, request_queue_t q,
208	struct gendisk bd_disk, struct sg_io_hdr hdr)
110	{	209	{
111	unsigned long start_time;	210	unsigned long start_time;
112	int reading, writing;	211	int reading, writing;
Lines 118-123 static int sg_io(request_queue_t *q, str Link Here
118	return -EINVAL;	217	return -EINVAL;
119	if (hdr->cmd_len > sizeof(rq->cmd))	218	if (hdr->cmd_len > sizeof(rq->cmd))
120	return -EINVAL;	219	return -EINVAL;
		220	if (verify_command(file, hdr->cmdp))
		221	return -EPERM;
121		222
122	/*	223	/*
123	* we'll do that later	224	* we'll do that later
Lines 218-225 static int sg_io(request_queue_t *q, str Link Here
218		319
219	#define OMAX_SB_LEN 16 /* For backward compatibility */	320	#define OMAX_SB_LEN 16 /* For backward compatibility */
220		321
221	static int sg_scsi_ioctl(request_queue_t q, struct gendisk bd_disk,	322	static int sg_scsi_ioctl(struct file file, request_queue_t q,
222	Scsi_Ioctl_Command *sic)	323	struct gendisk bd_disk, Scsi_Ioctl_Command __user sic)
223	{	324	{
224	struct request *rq;	325	struct request *rq;
225	int err, in_len, out_len, bytes, opcode, cmdlen;	326	int err, in_len, out_len, bytes, opcode, cmdlen;
Lines 261-266 static int sg_scsi_ioctl(request_queue_t Link Here
261	if (copy_from_user(buffer, sic->data + cmdlen, in_len))	362	if (copy_from_user(buffer, sic->data + cmdlen, in_len))
262	goto error;	363	goto error;
263		364
		365	err = verify_command(file, rq->cmd);
		366	if (err)
		367	goto error;
		368
264	switch (opcode) {	369	switch (opcode) {
265	case SEND_DIAGNOSTIC:	370	case SEND_DIAGNOSTIC:
266	case FORMAT_UNIT:	371	case FORMAT_UNIT:
Lines 369-375 int scsi_cmd_ioctl(struct file *file, st Link Here
369		474
370	old_cdb = hdr.cmdp;	475	old_cdb = hdr.cmdp;
371	hdr.cmdp = cdb;	476	hdr.cmdp = cdb;
372	err = sg_io(q, bd_disk, &hdr);	477	err = sg_io(file, q, bd_disk, &hdr);
373	if (err == -EFAULT)	478	if (err == -EFAULT)
374	break;	479	break;
375		480
Lines 418-424 int scsi_cmd_ioctl(struct file *file, st Link Here
418	hdr.cmdp = cgc.cmd;	523	hdr.cmdp = cgc.cmd;
419	hdr.cmd_len = sizeof(cgc.cmd);	524	hdr.cmd_len = sizeof(cgc.cmd);
420		525
421	err = sg_io(q, bd_disk, &hdr);	526	err = sg_io(file, q, bd_disk, &hdr);
422	if (err == -EFAULT)	527	if (err == -EFAULT)
423	break;	528	break;
424		529
Lines 441-447 int scsi_cmd_ioctl(struct file *file, st Link Here
441	if (!arg)	546	if (!arg)
442	break;	547	break;
443		548
444	err = sg_scsi_ioctl(q, bd_disk,	549	err = sg_scsi_ioctl(file, q, bd_disk,
445	(Scsi_Ioctl_Command *)arg);	550	(Scsi_Ioctl_Command *)arg);
446	break;	551	break;
447	case CDROMCLOSETRAY:	552	case CDROMCLOSETRAY: