lkml.org 
[lkml]   [2022]   [Oct]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 024/229] scsi: stex: Properly zero out the passthrough command structure
    Date
    From: Linus Torvalds <torvalds@linux-foundation.org>

    commit 6022f210461fef67e6e676fd8544ca02d1bcfa7a upstream.

    The passthrough structure is declared off of the stack, so it needs to be
    set to zero before copied back to userspace to prevent any unintentional
    data leakage. Switch things to be statically allocated which will fill the
    unused fields with 0 automatically.

    Link: https://lore.kernel.org/r/YxrjN3OOw2HHl9tx@kroah.com
    Cc: stable@kernel.org
    Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
    Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
    Cc: Dan Carpenter <dan.carpenter@oracle.com>
    Reported-by: hdthky <hdthky0@gmail.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/scsi/stex.c | 17 +++++++++--------
    include/scsi/scsi_cmnd.h | 2 +-
    2 files changed, 10 insertions(+), 9 deletions(-)

    --- a/drivers/scsi/stex.c
    +++ b/drivers/scsi/stex.c
    @@ -673,16 +673,17 @@ stex_queuecommand_lck(struct scsi_cmnd *
    return 0;
    case PASSTHRU_CMD:
    if (cmd->cmnd[1] == PASSTHRU_GET_DRVVER) {
    - struct st_drvver ver;
    + const struct st_drvver ver = {
    + .major = ST_VER_MAJOR,
    + .minor = ST_VER_MINOR,
    + .oem = ST_OEM,
    + .build = ST_BUILD_VER,
    + .signature[0] = PASSTHRU_SIGNATURE,
    + .console_id = host->max_id - 1,
    + .host_no = hba->host->host_no,
    + };
    size_t cp_len = sizeof(ver);

    - ver.major = ST_VER_MAJOR;
    - ver.minor = ST_VER_MINOR;
    - ver.oem = ST_OEM;
    - ver.build = ST_BUILD_VER;
    - ver.signature[0] = PASSTHRU_SIGNATURE;
    - ver.console_id = host->max_id - 1;
    - ver.host_no = hba->host->host_no;
    cp_len = scsi_sg_copy_from_buffer(cmd, &ver, cp_len);
    cmd->result = sizeof(ver) == cp_len ?
    DID_OK << 16 | COMMAND_COMPLETE << 8 :
    --- a/include/scsi/scsi_cmnd.h
    +++ b/include/scsi/scsi_cmnd.h
    @@ -227,7 +227,7 @@ static inline struct scsi_data_buffer *s
    }

    static inline int scsi_sg_copy_from_buffer(struct scsi_cmnd *cmd,
    - void *buf, int buflen)
    + const void *buf, int buflen)
    {
    return sg_copy_from_buffer(scsi_sglist(cmd), scsi_sg_count(cmd),
    buf, buflen);

    \
     
     \ /
      Last update: 2022-10-24 14:31    [W:4.782 / U:0.148 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site