path: root/block/bsg.c
diff options
authorBart Van Assche <>2017-05-31 14:43:47 -0700
committerJens Axboe <>2017-06-01 13:10:41 -0600
commitd9f972644606ecc2581390b43cb5a980b54c04bf (patch)
treed3d18ca37ba991b198665560eae8d24cfbacc949 /block/bsg.c
parent9efc160f4bbd69b17b48edec53067537d04e62b7 (diff)
bsg: Check queue type before attaching to a queue
Since BSG only supports request queues for which struct scsi_request is the first member of their private request data, refuse to register block layer queues for which struct scsi_request is not the first member of their private data. References: commit bd1599d931ca ("scsi_transport_sas: fix BSG ioctl memory corruption") References: commit 82ed4db499b8 ("block: split scsi_request out of struct request") Signed-off-by: Bart Van Assche <> Reviewed-by: Hannes Reinecke <> Reviewed-by: Christoph Hellwig <> Cc: Omar Sandoval <> Signed-off-by: Jens Axboe <>
Diffstat (limited to 'block/bsg.c')
1 files changed, 6 insertions, 0 deletions
diff --git a/block/bsg.c b/block/bsg.c
index 6fd08544d77e..40db8ff4c618 100644
--- a/block/bsg.c
+++ b/block/bsg.c
@@ -750,6 +750,12 @@ static struct bsg_device *bsg_add_device(struct inode *inode,
#ifdef BSG_DEBUG
unsigned char buf[32];
+ if (!blk_queue_scsi_passthrough(rq)) {
+ WARN_ONCE(true, "Attempt to register a non-SCSI queue\n");
+ return ERR_PTR(-EINVAL);
+ }
if (!blk_get_queue(rq))
return ERR_PTR(-ENXIO);