| Message ID | 20170623142428.817-2-seth.forshee@canonical.com |
|---|---|
| State | New |
| Headers | show |
On 23/06/17 15:24, Seth Forshee wrote: > BugLink: http://bugs.launchpad.net/bugs/1700077 > > Both aac_send_raw_srb() and aac_get_hba_info() may copy stack > allocated structs to userspace without initializing all members > of these structs. Clear out this memory to prevent information > leaks. > > Signed-off-by: Seth Forshee <seth.forshee@canonical.com> > --- > drivers/scsi/aacraid/commctrl.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c > index 106b9332f718..176220ae6961 100644 > --- a/drivers/scsi/aacraid/commctrl.c > +++ b/drivers/scsi/aacraid/commctrl.c > @@ -949,6 +949,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg) > &((struct aac_native_hba *)srbfib->hw_fib_va)->resp.err; > struct aac_srb_reply reply; > > + memset(&reply, 0, sizeof(reply)); > reply.status = ST_OK; > if (srbfib->flags & FIB_CONTEXT_FLAG_FASTRESP) { > /* fast response */ > @@ -1018,6 +1019,7 @@ static int aac_get_hba_info(struct aac_dev *dev, void __user *arg) > { > struct aac_hba_info hbainfo; > > + memset(&hbainfo, 0, sizeof(hbainfo)); > hbainfo.adapter_number = (u8) dev->id; > hbainfo.system_io_bus_number = dev->pdev->bus->number; > hbainfo.device_number = (dev->pdev->devfn >> 3); > Thanks Seth, I'm glad you spotted a second leak there as well. Acked-by: Colin Ian King <colin.king@canonical.com>
On 23.06.2017 16:24, Seth Forshee wrote: > BugLink: http://bugs.launchpad.net/bugs/1700077 > > Both aac_send_raw_srb() and aac_get_hba_info() may copy stack > allocated structs to userspace without initializing all members > of these structs. Clear out this memory to prevent information > leaks. > > Signed-off-by: Seth Forshee <seth.forshee@canonical.com> Acked-by: Stefan Bader <stefan.bader@canonical.com> > --- > drivers/scsi/aacraid/commctrl.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c > index 106b9332f718..176220ae6961 100644 > --- a/drivers/scsi/aacraid/commctrl.c > +++ b/drivers/scsi/aacraid/commctrl.c > @@ -949,6 +949,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg) > &((struct aac_native_hba *)srbfib->hw_fib_va)->resp.err; > struct aac_srb_reply reply; > > + memset(&reply, 0, sizeof(reply)); > reply.status = ST_OK; > if (srbfib->flags & FIB_CONTEXT_FLAG_FASTRESP) { > /* fast response */ > @@ -1018,6 +1019,7 @@ static int aac_get_hba_info(struct aac_dev *dev, void __user *arg) > { > struct aac_hba_info hbainfo; > > + memset(&hbainfo, 0, sizeof(hbainfo)); > hbainfo.adapter_number = (u8) dev->id; > hbainfo.system_io_bus_number = dev->pdev->bus->number; > hbainfo.device_number = (dev->pdev->devfn >> 3); >
diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c index 106b9332f718..176220ae6961 100644 --- a/drivers/scsi/aacraid/commctrl.c +++ b/drivers/scsi/aacraid/commctrl.c @@ -949,6 +949,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg) &((struct aac_native_hba *)srbfib->hw_fib_va)->resp.err; struct aac_srb_reply reply; + memset(&reply, 0, sizeof(reply)); reply.status = ST_OK; if (srbfib->flags & FIB_CONTEXT_FLAG_FASTRESP) { /* fast response */ @@ -1018,6 +1019,7 @@ static int aac_get_hba_info(struct aac_dev *dev, void __user *arg) { struct aac_hba_info hbainfo; + memset(&hbainfo, 0, sizeof(hbainfo)); hbainfo.adapter_number = (u8) dev->id; hbainfo.system_io_bus_number = dev->pdev->bus->number; hbainfo.device_number = (dev->pdev->devfn >> 3);
BugLink: http://bugs.launchpad.net/bugs/1700077 Both aac_send_raw_srb() and aac_get_hba_info() may copy stack allocated structs to userspace without initializing all members of these structs. Clear out this memory to prevent information leaks. Signed-off-by: Seth Forshee <seth.forshee@canonical.com> --- drivers/scsi/aacraid/commctrl.c | 2 ++ 1 file changed, 2 insertions(+)