Re: [PATCH v1 2/4] smartpqi: add support for CCISS_BIG_PASSTHRU ioctl
David Strahan <[email protected]>
| Newsgroups | org.kernel.vger.linux-scsi |
|---|---|
| Message-ID | <[email protected]> |
Re: commit 89c5d7119f80d6cae47c460c85b511017c1cd263
[PATCH v1 2/4] smartpqi: add support for CCISS_BIG_PASSTHRU ioctl
Link: https://lore.kernel.org/linux-scsi/[email protected]/
Sashiko AI review (https://sashiko.dev/#/patchset/[email protected]?part=2):
> [High] Unbounded kmalloc of user-controlled size prevents large transfers
> and triggers page allocation warnings.
> [High] Missing 32-bit compat ioctl translation for CCISS_BIG_PASSTHRU.
Agreed on both. pqi_big_passthru_ioctl() doesn't bound iocommand.buf_size
before kmalloc(), and doesn't honor iocommand.malloc_size to split large
transfers across multiple SG entries.
For context, the userspace tooling we ship that issues this ioctl is
designed to keep buf_size within a bounded range, so this isn't an active
exposure via our own utilities today -- but the kernel-side bound is
still missing for any other caller, and is worth closing.
There's also no compat_ioctl for 32-bit callers -- scsi_ioctl() checks
in_compat_syscall() and returns -EINVAL cleanly when hostt->compat_ioctl
is unset, so this is a supportability gap, not a safety issue.
We would like to let this patch stand as posted and address these in a
follow-up patch rather than hold up the series.