From: "Martin K. Petersen" <martin.petersen@oracle.com>
To: Phillip Potter <phil@philpotter.co.uk>
Cc: jejb@linux.ibm.com, martin.petersen@oracle.com,
linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] scsi: sd: skip checks when media is present if sd_read_capacity reports zero
Date: Fri, 21 May 2021 16:00:10 -0400 [thread overview]
Message-ID: <yq1pmxj526p.fsf@ca-mkp.ca.oracle.com> (raw)
In-Reply-To: <20210506073610.33867-1-phil@philpotter.co.uk> (Phillip Potter's message of "Thu, 6 May 2021 08:36:10 +0100")
Hello Phillip!
> In sd_revalidate_disk, if sdkp->media_present is set, then sdkp->capacity
> should not be zero. Therefore, jump to end of if block and skip remaining
> checks/calls. Fixes a KMSAN-found uninit-value bug reported by syzbot at:
> https://syzkaller.appspot.com/bug?id=197c8a3a2de61720a9b500ad485a7aba0065c6af
The reported read of an uninitialized value is in scsi_mode_sense()
while inspecting a buffer returned from sending a MODE SENSE command to
the device. The buffer in question is memset() before executing the MODE
SENSE command. And we only look at the buffer contents if the MODE SENSE
operation was successful.
As far as I can tell the only way to end up reading uninitialized data
is if the device successfully completes the command but fails to
transfer the data buffer.
But maybe I'm missing something?
--
Martin K. Petersen Oracle Linux Engineering
next prev parent reply other threads:[~2021-05-21 20:00 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-06 7:36 [PATCH] scsi: sd: skip checks when media is present if sd_read_capacity reports zero Phillip Potter
2021-05-21 20:00 ` Martin K. Petersen [this message]
2021-05-23 0:06 ` Phillip Potter
2021-05-26 4:04 ` Martin K. Petersen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=yq1pmxj526p.fsf@ca-mkp.ca.oracle.com \
--to=martin.petersen@oracle.com \
--cc=jejb@linux.ibm.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=phil@philpotter.co.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).