linux-kernel - re: [SCSI] compat_ioct: fix bsg SG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 02 Nov 2011 12:58:58 +0400
From:	James Bottomley <James.Bottomley@...senPartnership.com>
To:	Dan Carpenter <dan.carpenter@...cle.com>
Cc:	FUJITA Tomonori <fujita.tomonori@....ntt.co.jp>,
	Giridhar Malavali <giridhar.malavali@...gic.com>,
	linux-scsi@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: re: [SCSI] compat_ioct: fix bsg SG_IO

On Wed, 2011-11-02 at 11:16 +0300, Dan Carpenter wrote:
> 84eb8fb42c120 "[SCSI] compat_ioct: fix bsg SG_IO" introduces an
> uninitialized variable use.
> 
>    278  static int sg_ioctl_trans(unsigned int fd, unsigned int cmd,
>    279                          sg_io_hdr32_t __user *sgio32)
>    280  {
>    281          sg_io_hdr_t __user *sgio;
>    282          u16 iovec_count;
>    283          u32 data;
>    284          void __user *dxferp;
>    285          int err;
>    286          int interface_id;
>    287  
>    288          if (get_user(interface_id, &sgio32->interface_id))
>                                             ^^^^^^
> sgio32 is unitialized here.  Unfortunately Gcc doesn't warn about it.

I don't quite understand what makes you think that: it's passed in as an
argument to the function.  It's a pointer to the userspace 32 bit
representation of the structure.  The use logic is a slightly convoluted
way of saying we only understand the 'S' header but we're going to let
the real ioctl routine say what the error is if it's not type 'S'.

James


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/