Commit 7353dc06 authored by Christoph Hellwig's avatar Christoph Hellwig Committed by Martin K. Petersen
Browse files

scsi: scsi_ioctl: Simplify SCSI passthrough permission checking 

Remove the separate command filter structure and just use a switch
statement (which also cought two duplicate commands), return a bool and
give the function a sensible name.

Link: https://lore.kernel.org/r/20210724072033.1284840-18-hch@lst.de


Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent b69367df

block/scsi_ioctl.c

+99 −120
Original line number Diff line number Diff line
@@ -22,13 +22,6 @@ 
#include <scsi/scsi_cmnd.h>

#include <scsi/sg.h>



struct blk_cmd_filter {

	unsigned long read_ok[BLK_SCSI_CMD_PER_LONG];

	unsigned long write_ok[BLK_SCSI_CMD_PER_LONG];

};



static struct blk_cmd_filter blk_default_cmd_filter;



static int sg_get_version(int __user *p)

{

	static const int sg_version_num = 30527;
@@ -80,115 +73,108 @@ static int sg_emulated_host(struct request_queue *q, int __user *p) 
	return put_user(1, p);

}



static void blk_set_cmd_filter_defaults(struct blk_cmd_filter *filter)

{

	/* Basic read-only commands */

	__set_bit(TEST_UNIT_READY, filter->read_ok);

	__set_bit(REQUEST_SENSE, filter->read_ok);

	__set_bit(READ_6, filter->read_ok);

	__set_bit(READ_10, filter->read_ok);

	__set_bit(READ_12, filter->read_ok);

	__set_bit(READ_16, filter->read_ok);

	__set_bit(READ_BUFFER, filter->read_ok);

	__set_bit(READ_DEFECT_DATA, filter->read_ok);

	__set_bit(READ_CAPACITY, filter->read_ok);

	__set_bit(READ_LONG, filter->read_ok);

	__set_bit(INQUIRY, filter->read_ok);

	__set_bit(MODE_SENSE, filter->read_ok);

	__set_bit(MODE_SENSE_10, filter->read_ok);

	__set_bit(LOG_SENSE, filter->read_ok);

	__set_bit(START_STOP, filter->read_ok);

	__set_bit(GPCMD_VERIFY_10, filter->read_ok);

	__set_bit(VERIFY_16, filter->read_ok);

	__set_bit(REPORT_LUNS, filter->read_ok);

	__set_bit(SERVICE_ACTION_IN_16, filter->read_ok);

	__set_bit(RECEIVE_DIAGNOSTIC, filter->read_ok);

	__set_bit(MAINTENANCE_IN, filter->read_ok);

	__set_bit(GPCMD_READ_BUFFER_CAPACITY, filter->read_ok);



	/* Audio CD commands */

	__set_bit(GPCMD_PLAY_CD, filter->read_ok);

	__set_bit(GPCMD_PLAY_AUDIO_10, filter->read_ok);

	__set_bit(GPCMD_PLAY_AUDIO_MSF, filter->read_ok);

	__set_bit(GPCMD_PLAY_AUDIO_TI, filter->read_ok);

	__set_bit(GPCMD_PAUSE_RESUME, filter->read_ok);



	/* CD/DVD data reading */

	__set_bit(GPCMD_READ_CD, filter->read_ok);

	__set_bit(GPCMD_READ_CD_MSF, filter->read_ok);

	__set_bit(GPCMD_READ_DISC_INFO, filter->read_ok);

	__set_bit(GPCMD_READ_CDVD_CAPACITY, filter->read_ok);

	__set_bit(GPCMD_READ_DVD_STRUCTURE, filter->read_ok);

	__set_bit(GPCMD_READ_HEADER, filter->read_ok);

	__set_bit(GPCMD_READ_TRACK_RZONE_INFO, filter->read_ok);

	__set_bit(GPCMD_READ_SUBCHANNEL, filter->read_ok);

	__set_bit(GPCMD_READ_TOC_PMA_ATIP, filter->read_ok);

	__set_bit(GPCMD_REPORT_KEY, filter->read_ok);

	__set_bit(GPCMD_SCAN, filter->read_ok);

	__set_bit(GPCMD_GET_CONFIGURATION, filter->read_ok);

	__set_bit(GPCMD_READ_FORMAT_CAPACITIES, filter->read_ok);

	__set_bit(GPCMD_GET_EVENT_STATUS_NOTIFICATION, filter->read_ok);

	__set_bit(GPCMD_GET_PERFORMANCE, filter->read_ok);

	__set_bit(GPCMD_SEEK, filter->read_ok);

	__set_bit(GPCMD_STOP_PLAY_SCAN, filter->read_ok);



	/* Basic writing commands */

	__set_bit(WRITE_6, filter->write_ok);

	__set_bit(WRITE_10, filter->write_ok);

	__set_bit(WRITE_VERIFY, filter->write_ok);

	__set_bit(WRITE_12, filter->write_ok);

	__set_bit(WRITE_VERIFY_12, filter->write_ok);

	__set_bit(WRITE_16, filter->write_ok);

	__set_bit(WRITE_LONG, filter->write_ok);

	__set_bit(WRITE_LONG_2, filter->write_ok);

	__set_bit(WRITE_SAME, filter->write_ok);

	__set_bit(WRITE_SAME_16, filter->write_ok);

	__set_bit(WRITE_SAME_32, filter->write_ok);

	__set_bit(ERASE, filter->write_ok);

	__set_bit(GPCMD_MODE_SELECT_10, filter->write_ok);

	__set_bit(MODE_SELECT, filter->write_ok);

	__set_bit(LOG_SELECT, filter->write_ok);

	__set_bit(GPCMD_BLANK, filter->write_ok);

	__set_bit(GPCMD_CLOSE_TRACK, filter->write_ok);

	__set_bit(GPCMD_FLUSH_CACHE, filter->write_ok);

	__set_bit(GPCMD_FORMAT_UNIT, filter->write_ok);

	__set_bit(GPCMD_REPAIR_RZONE_TRACK, filter->write_ok);

	__set_bit(GPCMD_RESERVE_RZONE_TRACK, filter->write_ok);

	__set_bit(GPCMD_SEND_DVD_STRUCTURE, filter->write_ok);

	__set_bit(GPCMD_SEND_EVENT, filter->write_ok);

	__set_bit(GPCMD_SEND_KEY, filter->write_ok);

	__set_bit(GPCMD_SEND_OPC, filter->write_ok);

	__set_bit(GPCMD_SEND_CUE_SHEET, filter->write_ok);

	__set_bit(GPCMD_SET_SPEED, filter->write_ok);

	__set_bit(GPCMD_PREVENT_ALLOW_MEDIUM_REMOVAL, filter->write_ok);

	__set_bit(GPCMD_LOAD_UNLOAD, filter->write_ok);

	__set_bit(GPCMD_SET_STREAMING, filter->write_ok);

	__set_bit(GPCMD_SET_READ_AHEAD, filter->write_ok);



	/* ZBC Commands */

	__set_bit(ZBC_OUT, filter->write_ok);

	__set_bit(ZBC_IN, filter->read_ok);

}



int blk_verify_command(unsigned char *cmd, fmode_t mode)

/*

 * Check if the given command is allowed.

 *

 * For unprivileged users only a small set of whitelisted command is allowed so

 * that they can't format the drive or update the firmware.

 */

bool scsi_cmd_allowed(unsigned char *cmd, fmode_t mode)

{

	struct blk_cmd_filter *filter = &blk_default_cmd_filter;



	/* root can do any command. */

	if (capable(CAP_SYS_RAWIO))

		return 0;

		return true;



	/* Anybody who can open the device can do a read-safe command */

	if (test_bit(cmd[0], filter->read_ok))

		return 0;



	/* Write-safe commands require a writable open */

	if (test_bit(cmd[0], filter->write_ok) && (mode & FMODE_WRITE))

		return 0;



	return -EPERM;

	switch (cmd[0]) {

	/* Basic read-only commands */

	case TEST_UNIT_READY:

	case REQUEST_SENSE:

	case READ_6:

	case READ_10:

	case READ_12:

	case READ_16:

	case READ_BUFFER:

	case READ_DEFECT_DATA:

	case READ_CAPACITY: /* also GPCMD_READ_CDVD_CAPACITY */

	case READ_LONG:

	case INQUIRY:

	case MODE_SENSE:

	case MODE_SENSE_10:

	case LOG_SENSE:

	case START_STOP:

	case GPCMD_VERIFY_10:

	case VERIFY_16:

	case REPORT_LUNS:

	case SERVICE_ACTION_IN_16:

	case RECEIVE_DIAGNOSTIC:

	case MAINTENANCE_IN: /* also GPCMD_SEND_KEY, which is a write command */

	case GPCMD_READ_BUFFER_CAPACITY:

	/* Audio CD commands */

	case GPCMD_PLAY_CD:

	case GPCMD_PLAY_AUDIO_10:

	case GPCMD_PLAY_AUDIO_MSF:

	case GPCMD_PLAY_AUDIO_TI:

	case GPCMD_PAUSE_RESUME:

	/* CD/DVD data reading */

	case GPCMD_READ_CD:

	case GPCMD_READ_CD_MSF:

	case GPCMD_READ_DISC_INFO:

	case GPCMD_READ_DVD_STRUCTURE:

	case GPCMD_READ_HEADER:

	case GPCMD_READ_TRACK_RZONE_INFO:

	case GPCMD_READ_SUBCHANNEL:

	case GPCMD_READ_TOC_PMA_ATIP:

	case GPCMD_REPORT_KEY:

	case GPCMD_SCAN:

	case GPCMD_GET_CONFIGURATION:

	case GPCMD_READ_FORMAT_CAPACITIES:

	case GPCMD_GET_EVENT_STATUS_NOTIFICATION:

	case GPCMD_GET_PERFORMANCE:

	case GPCMD_SEEK:

	case GPCMD_STOP_PLAY_SCAN:

	/* ZBC */

	case ZBC_IN:

		return true;

	/* Basic writing commands */

	case WRITE_6:

	case WRITE_10:

	case WRITE_VERIFY:

	case WRITE_12:

	case WRITE_VERIFY_12:

	case WRITE_16:

	case WRITE_LONG:

	case WRITE_LONG_2:

	case WRITE_SAME:

	case WRITE_SAME_16:

	case WRITE_SAME_32:

	case ERASE:

	case GPCMD_MODE_SELECT_10:

	case MODE_SELECT:

	case LOG_SELECT:

	case GPCMD_BLANK:

	case GPCMD_CLOSE_TRACK:

	case GPCMD_FLUSH_CACHE:

	case GPCMD_FORMAT_UNIT:

	case GPCMD_REPAIR_RZONE_TRACK:

	case GPCMD_RESERVE_RZONE_TRACK:

	case GPCMD_SEND_DVD_STRUCTURE:

	case GPCMD_SEND_EVENT:

	case GPCMD_SEND_OPC:

	case GPCMD_SEND_CUE_SHEET:

	case GPCMD_SET_SPEED:

	case GPCMD_PREVENT_ALLOW_MEDIUM_REMOVAL:

	case GPCMD_LOAD_UNLOAD:

	case GPCMD_SET_STREAMING:

	case GPCMD_SET_READ_AHEAD:

	/* ZBC */

	case ZBC_OUT:

		return (mode & FMODE_WRITE);

	default:

		return false;

	}

EXPORT_SYMBOL(blk_verify_command);

}

EXPORT_SYMBOL(scsi_cmd_allowed);



static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,

			     struct sg_io_hdr *hdr, fmode_t mode)
@@ -197,7 +183,7 @@ static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq, 


	if (copy_from_user(req->cmd, hdr->cmdp, hdr->cmd_len))

		return -EFAULT;

	if (blk_verify_command(req->cmd, mode))

	if (!scsi_cmd_allowed(req->cmd, mode))

		return -EPERM;



	/*
@@ -428,8 +414,8 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode, 
	if (in_len && copy_from_user(buffer, sic->data + cmdlen, in_len))

		goto error;



	err = blk_verify_command(req->cmd, mode);

	if (err)

	err = -EPERM;

	if (!scsi_cmd_allowed(req->cmd, mode))

		goto error;



	/* default.  possible overriden later */
@@ -808,10 +794,3 @@ int scsi_cmd_ioctl(struct request_queue *q, struct gendisk *bd_disk, fmode_t mod 
	return err;

}

EXPORT_SYMBOL(scsi_cmd_ioctl);
 


static int __init blk_scsi_ioctl_init(void)

{

	blk_set_cmd_filter_defaults(&blk_default_cmd_filter);

	return 0;

}

fs_initcall(blk_scsi_ioctl_init);

drivers/scsi/scsi_bsg.c

+1 −1
Original line number Diff line number Diff line
@@ -36,7 +36,7 @@ static int scsi_bsg_fill_hdr(struct request *rq, struct sg_io_v4 *hdr, 


	if (copy_from_user(sreq->cmd, uptr64(hdr->request), sreq->cmd_len))

		return -EFAULT;

	if (blk_verify_command(sreq->cmd, mode))

	if (!scsi_cmd_allowed(sreq->cmd, mode))

		return -EPERM;

	return 0;

}

drivers/scsi/sg.c

+3 −2
Original line number Diff line number Diff line
@@ -238,8 +238,9 @@ static int sg_allow_access(struct file *filp, unsigned char *cmd) 


	if (sfp->parentdp->device->type == TYPE_SCANNER)

		return 0;



	return blk_verify_command(cmd, filp->f_mode);

	if (!scsi_cmd_allowed(cmd, filp->f_mode))

		return -EPERM;

	return 0;

}



static int

include/linux/blkdev.h

+1 −1
Original line number Diff line number Diff line
@@ -1343,7 +1343,7 @@ static inline int sb_issue_zeroout(struct super_block *sb, sector_t block, 
				    gfp_mask, 0);

}



extern int blk_verify_command(unsigned char *cmd, fmode_t mode);

bool scsi_cmd_allowed(unsigned char *cmd, fmode_t mode);



static inline bool bdev_is_partition(struct block_device *bdev)

{