[PATCH] scsi: scsi_dh_rdac: zero cdb in send_mode_select()

From: Martin Wilck <Martin.Wilck@suse.com>
To: "Martin K. Petersen" <martin.petersen@oracle.com>,
	James Bottomley <jejb@linux.vnet.ibm.com>,
	Hannes Reinecke <hare@suse.de>
Cc: "linux-scsi@vger.kernel.org" <linux-scsi@vger.kernel.org>,
	Martin Wilck <Martin.Wilck@suse.com>,
	Ales Novak <alnovak@suse.cz>
Subject: [PATCH] scsi: scsi_dh_rdac: zero cdb in send_mode_select()
Date: Wed, 4 Sep 2019 15:52:29 +0000	[thread overview]
Message-ID: <20190904155205.1666-1-martin.wilck@suse.com> (raw)

From: Ales Novak <alnovak@suse.cz>

cdb in send_mode_select() is not zeroed and is only partially filled in
rdac_failover_get(), which leads to some random data getting to the
device. Users have reported storage responding to such commands with
INVALID FIELD IN CDB. Code before commit 327825574132 was not affected,
as it called blk_rq_set_block_pc().

Fix this by zeroing out the cdb first.

Identified & fix proposed by HPE.

Fixes: 327825574132 ("scsi_dh_rdac: switch to scsi_execute_req_flags()")
Acked-by: Ales Novak <alnovak@suse.cz>
Signed-off-by: Martin Wilck <mwilck@suse.com>
Cc: stable@vger.kernel.org
---
 drivers/scsi/device_handler/scsi_dh_rdac.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/scsi/device_handler/scsi_dh_rdac.c b/drivers/scsi/device_handler/scsi_dh_rdac.c
index 65f1fe3..5efc959 100644
--- a/drivers/scsi/device_handler/scsi_dh_rdac.c
+++ b/drivers/scsi/device_handler/scsi_dh_rdac.c
@@ -546,6 +546,8 @@ static void send_mode_select(struct work_struct *work)
 	spin_unlock(&ctlr->ms_lock);
 
  retry:
+	memset(cdb, 0, sizeof(cdb));
+
 	data_size = rdac_failover_get(ctlr, &list, cdb);
 
 	RDAC_LOG(RDAC_LOG_FAILOVER, sdev, "array %s, ctlr %d, "
-- 
2.23.0

