Re: [PATCH] scsi: aacraid: Don't copy uninitialized stack memory to userspace
Seth, > Both aac_send_raw_srb() and aac_get_hba_info() may copy stack > allocated structs to userspace without initializing all members of > these structs. Clear out this memory to prevent information leaks. Applied to 4.13/scsi-queue. Thank you! -- Martin K. Petersen Oracle Linux Engineering
Re: [PATCH] scsi: aacraid: Don't copy uninitialized stack memory to userspace
On Fri, Jun 23, 2017 at 09:04:22AM -0500, Seth Forshee wrote: > Both aac_send_raw_srb() and aac_get_hba_info() may copy stack > allocated structs to userspace without initializing all members > of these structs. Clear out this memory to prevent information > leaks. > > Fixes: 423400e64d377 ("scsi: aacraid: Include HBA direct interface") > Fixes: c799d519bf088 ("scsi: aacraid: Retrieve HBA host information ioctl") > Signed-off-by: Seth Forshee> --- Looks good, Reviewed-by: Johannes Thumshirn -- Johannes Thumshirn Storage jthumsh...@suse.de+49 911 74053 689 SUSE LINUX GmbH, Maxfeldstr. 5, 90409 Nürnberg GF: Felix Imendörffer, Jane Smithard, Graham Norton HRB 21284 (AG Nürnberg) Key fingerprint = EC38 9CAB C2C4 F25D 8600 D0D0 0393 969D 2D76 0850
[PATCH] scsi: aacraid: Don't copy uninitialized stack memory to userspace
Both aac_send_raw_srb() and aac_get_hba_info() may copy stack allocated structs to userspace without initializing all members of these structs. Clear out this memory to prevent information leaks. Fixes: 423400e64d377 ("scsi: aacraid: Include HBA direct interface") Fixes: c799d519bf088 ("scsi: aacraid: Retrieve HBA host information ioctl") Signed-off-by: Seth Forshee--- drivers/scsi/aacraid/commctrl.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c index d2f8d5954840..476ada6e39d0 100644 --- a/drivers/scsi/aacraid/commctrl.c +++ b/drivers/scsi/aacraid/commctrl.c @@ -950,6 +950,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg) &((struct aac_native_hba *)srbfib->hw_fib_va)->resp.err; struct aac_srb_reply reply; + memset(, 0, sizeof(reply)); reply.status = ST_OK; if (srbfib->flags & FIB_CONTEXT_FLAG_FASTRESP) { /* fast response */ @@ -1019,6 +1020,7 @@ static int aac_get_hba_info(struct aac_dev *dev, void __user *arg) { struct aac_hba_info hbainfo; + memset(, 0, sizeof(hbainfo)); hbainfo.adapter_number = (u8) dev->id; hbainfo.system_io_bus_number= dev->pdev->bus->number; hbainfo.device_number = (dev->pdev->devfn >> 3); -- 2.11.0