Kernel/linux-next
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git synced 2025-01-10 15:58:47 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

SCSI fixes on 20220423

Browse Source 
One fix for an information leak caused by copying a buffer to
 userspace without checking for error first in the sr driver.
 
 Signed-off-by: James E.J. Bottomley <jejb@linux.ibm.com>
 -----BEGIN PGP SIGNATURE-----
 
 iJwEABMIAEQWIQTnYEDbdso9F2cI+arnQslM7pishQUCYmRQ+SYcamFtZXMuYm90
 dG9tbGV5QGhhbnNlbnBhcnRuZXJzaGlwLmNvbQAKCRDnQslM7pishVhPAP9a/cHI
 0uZ8IC5LBjpXEyvvniGBIXz87i2IKR3XSme6BwEAxeH5AX54q4Pkhbr+izdEQM9/
 A09GaOdzQXHBsgD92+I=
 =MEyO
 -----END PGP SIGNATURE-----

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI fix from James Bottomley:
 "One fix for an information leak caused by copying a buffer to
  userspace without checking for error first in the sr driver"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: sr: Do not leak information in ioctl
This commit is contained in:
Linus Torvalds 2022-04-23 13:58:18 -07:00
commit 6fc2586d23
1 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
drivers/scsi/sr_ioctl.c
View File

@ -41,7 +41,7 @@ static int sr_read_tochdr(struct cdrom_device_info *cdi,
int result; int result;
unsigned char *buffer; unsigned char *buffer;
buffer = kmalloc(32, GFP_KERNEL); buffer = kzalloc(32, GFP_KERNEL);
if (!buffer) if (!buffer)
return -ENOMEM; return -ENOMEM;
@ -55,10 +55,13 @@ static int sr_read_tochdr(struct cdrom_device_info *cdi,
cgc.data_direction = DMA_FROM_DEVICE; cgc.data_direction = DMA_FROM_DEVICE;
result = sr_do_ioctl(cd, &cgc); result = sr_do_ioctl(cd, &cgc);
if (result)
goto err;
tochdr->cdth_trk0 = buffer[2]; tochdr->cdth_trk0 = buffer[2];
tochdr->cdth_trk1 = buffer[3]; tochdr->cdth_trk1 = buffer[3];
err:
kfree(buffer); kfree(buffer);
return result; return result;
} }
@ -71,7 +74,7 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi,
int result; int result;
unsigned char *buffer; unsigned char *buffer;
buffer = kmalloc(32, GFP_KERNEL); buffer = kzalloc(32, GFP_KERNEL);
if (!buffer) if (!buffer)
return -ENOMEM; return -ENOMEM;
@ -86,6 +89,8 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi,
cgc.data_direction = DMA_FROM_DEVICE; cgc.data_direction = DMA_FROM_DEVICE;
result = sr_do_ioctl(cd, &cgc); result = sr_do_ioctl(cd, &cgc);
if (result)
goto err;
tocentry->cdte_ctrl = buffer[5] & 0xf; tocentry->cdte_ctrl = buffer[5] & 0xf;
tocentry->cdte_adr = buffer[5] >> 4; tocentry->cdte_adr = buffer[5] >> 4;
@ -98,6 +103,7 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi,
tocentry->cdte_addr.lba = (((((buffer[8] << 8) + buffer[9]) << 8) tocentry->cdte_addr.lba = (((((buffer[8] << 8) + buffer[9]) << 8)
+ buffer[10]) << 8) + buffer[11]; + buffer[10]) << 8) + buffer[11];
err:
kfree(buffer); kfree(buffer);
return result; return result;
} }
@ -384,7 +390,7 @@ int sr_get_mcn(struct cdrom_device_info *cdi, struct cdrom_mcn *mcn)
{ {
Scsi_CD *cd = cdi->handle; Scsi_CD *cd = cdi->handle;
struct packet_command cgc; struct packet_command cgc;
char *buffer = kmalloc(32, GFP_KERNEL); char *buffer = kzalloc(32, GFP_KERNEL);
int result; int result;
if (!buffer) if (!buffer)
@ -400,10 +406,13 @@ int sr_get_mcn(struct cdrom_device_info *cdi, struct cdrom_mcn *mcn)
cgc.data_direction = DMA_FROM_DEVICE; cgc.data_direction = DMA_FROM_DEVICE;
cgc.timeout = IOCTL_TIMEOUT; cgc.timeout = IOCTL_TIMEOUT;
result = sr_do_ioctl(cd, &cgc); result = sr_do_ioctl(cd, &cgc);
if (result)
goto err;
memcpy(mcn->medium_catalog_number, buffer + 9, 13); memcpy(mcn->medium_catalog_number, buffer + 9, 13);
mcn->medium_catalog_number[13] = 0; mcn->medium_catalog_number[13] = 0;
err:
kfree(buffer); kfree(buffer);
return result; return result;
} }