* [PATCH] scsi: aacraid: Don't copy uninitialized stack memory to userspace
@ 2017-06-23 14:04 Seth Forshee
2017-06-23 14:11 ` Johannes Thumshirn
2017-06-26 17:36 ` Martin K. Petersen
0 siblings, 2 replies; 3+ messages in thread
From: Seth Forshee @ 2017-06-23 14:04 UTC (permalink / raw)
To: Adaptec OEM Raid Solutions, James E.J. Bottomley, Martin K. Petersen
Cc: Seth Forshee, linux-scsi, linux-kernel
Both aac_send_raw_srb() and aac_get_hba_info() may copy stack
allocated structs to userspace without initializing all members
of these structs. Clear out this memory to prevent information
leaks.
Fixes: 423400e64d377 ("scsi: aacraid: Include HBA direct interface")
Fixes: c799d519bf088 ("scsi: aacraid: Retrieve HBA host information ioctl")
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
---
drivers/scsi/aacraid/commctrl.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c
index d2f8d5954840..476ada6e39d0 100644
--- a/drivers/scsi/aacraid/commctrl.c
+++ b/drivers/scsi/aacraid/commctrl.c
@@ -950,6 +950,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
&((struct aac_native_hba *)srbfib->hw_fib_va)->resp.err;
struct aac_srb_reply reply;
+ memset(&reply, 0, sizeof(reply));
reply.status = ST_OK;
if (srbfib->flags & FIB_CONTEXT_FLAG_FASTRESP) {
/* fast response */
@@ -1019,6 +1020,7 @@ static int aac_get_hba_info(struct aac_dev *dev, void __user *arg)
{
struct aac_hba_info hbainfo;
+ memset(&hbainfo, 0, sizeof(hbainfo));
hbainfo.adapter_number = (u8) dev->id;
hbainfo.system_io_bus_number = dev->pdev->bus->number;
hbainfo.device_number = (dev->pdev->devfn >> 3);
--
2.11.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] scsi: aacraid: Don't copy uninitialized stack memory to userspace
2017-06-23 14:04 [PATCH] scsi: aacraid: Don't copy uninitialized stack memory to userspace Seth Forshee
@ 2017-06-23 14:11 ` Johannes Thumshirn
2017-06-26 17:36 ` Martin K. Petersen
1 sibling, 0 replies; 3+ messages in thread
From: Johannes Thumshirn @ 2017-06-23 14:11 UTC (permalink / raw)
To: Seth Forshee
Cc: Adaptec OEM Raid Solutions, James E.J. Bottomley,
Martin K. Petersen, linux-scsi, linux-kernel
On Fri, Jun 23, 2017 at 09:04:22AM -0500, Seth Forshee wrote:
> Both aac_send_raw_srb() and aac_get_hba_info() may copy stack
> allocated structs to userspace without initializing all members
> of these structs. Clear out this memory to prevent information
> leaks.
>
> Fixes: 423400e64d377 ("scsi: aacraid: Include HBA direct interface")
> Fixes: c799d519bf088 ("scsi: aacraid: Retrieve HBA host information ioctl")
> Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
> ---
Looks good,
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
--
Johannes Thumshirn Storage
jthumshirn@suse.de +49 911 74053 689
SUSE LINUX GmbH, Maxfeldstr. 5, 90409 Nürnberg
GF: Felix Imendörffer, Jane Smithard, Graham Norton
HRB 21284 (AG Nürnberg)
Key fingerprint = EC38 9CAB C2C4 F25D 8600 D0D0 0393 969D 2D76 0850
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] scsi: aacraid: Don't copy uninitialized stack memory to userspace
2017-06-23 14:04 [PATCH] scsi: aacraid: Don't copy uninitialized stack memory to userspace Seth Forshee
2017-06-23 14:11 ` Johannes Thumshirn
@ 2017-06-26 17:36 ` Martin K. Petersen
1 sibling, 0 replies; 3+ messages in thread
From: Martin K. Petersen @ 2017-06-26 17:36 UTC (permalink / raw)
To: Seth Forshee
Cc: Adaptec OEM Raid Solutions, James E.J. Bottomley,
Martin K. Petersen, linux-scsi, linux-kernel
Seth,
> Both aac_send_raw_srb() and aac_get_hba_info() may copy stack
> allocated structs to userspace without initializing all members of
> these structs. Clear out this memory to prevent information leaks.
Applied to 4.13/scsi-queue. Thank you!
--
Martin K. Petersen Oracle Linux Engineering
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-06-26 17:37 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-06-23 14:04 [PATCH] scsi: aacraid: Don't copy uninitialized stack memory to userspace Seth Forshee
2017-06-23 14:11 ` Johannes Thumshirn
2017-06-26 17:36 ` Martin K. Petersen
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.