All four copy_from_user calls in the driver previously printed a warning
but continued execution with uninitialized (slab garbage) data, which
could trigger unintended command execution, kernel crashes from garbage
pointer dereferences, or infoleaks via copy_to_user.
Now each copy_from_user failure frees any allocated structs, releases
the queue slot where applicable, and returns -EFAULT immediately.
- mmap close handlers used free_page() instead of free_pages() with
the matching order, leaking 31 pages (mmap_m) or 1023 pages (mmap_tb,
mmap_mdb) per open/close cycle (~4MB per TB/MDB open/close).
- READ_MEMORY_DRIVE_COMMAND capability check returned -EPERM without
freeing the just-allocated control_obj.
- SG_IO v3 and v4 paths never freed the sg_io_hdr / sg_io_v4 structs
allocated at entry, leaking ~200 bytes per SG_IO command.
Prevent unprivileged physical memory reads via the memory drive
command. Only processes with CAP_SYS_RAWIO capability (typically
root) can now execute this ioctl. Returns -EPERM otherwise.
Replace hardcoded hmodel/hserial INQUIRY response with actual source
drive model/serial strings forwarded from userspace. Add model[40]
and serial[20] fields to control_data struct (after buffer to preserve
ABI). Driver stores them on START_DRIVE/START_FILE commands and
process_inquiry returns them at standard SCSI INQUIRY byte positions
(8-31 vendor+product, 36-43 serial). Falls back to previous behavior
only if model string is empty.
Add spinlock driver_lock to protect queue_count, working_queue and
request_queue from concurrent access between IOCTL handler and
block device request handler.
Wrap all cross-context flag reads (stop_signal, data_drive_active,
lockup_detected, return_zeros_on_error, io_scsi_only) with READ_ONCE
and all writes with WRITE_ONCE to prevent compiler-mangled reads and
tearing. These flags are accessed from both the IOCTL control path
and the block device data path without an explicit lock.
Protect queue counter resets in START command with the spinlock.
Add handlers for TEST UNIT READY, REQUEST SENSE, START STOP UNIT,
PREVENT ALLOW MEDIUM REMOVAL, MODE SENSE(6/10), MODE SELECT(6/10),
FORMAT UNIT, SYNCHRONIZE CACHE(10/16), VERIFY(10/16),
READ FORMAT CAPACITIES, READ DEFECT DATA(10/12), REPORT LUNS,
and REZERO UNIT.
Most return success immediately (no-op for a virtual device backed
by userspace). Write/modify commands return -EROFS. Previously all
fell through to -EINVAL, causing OS utilities to retry or time out.
Julian Frohmüller