linux-kernel - [PATCH v2] scsi: zero per-cmd private driver data for each MQ I/O

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 18 May 2017 15:40:05 -0700
From:   Long Li <longli@...hange.microsoft.com>
To:     "James E.J. Bottomley" <jejb@...ux.vnet.ibm.com>,
        "Martin K. Petersen" <martin.petersen@...cle.com>,
        linux-scsi@...r.kernel.org, linux-kernel@...r.kernel.org,
        KY Srinivasan <kys@...rosoft.com>,
        Bart Van Assche <Bart.VanAssche@...disk.com>,
        Christoph Hellwig <hch@...radead.org>,
        Stephen Hemminger <sthemmin@...rosoft.com>
Cc:     Long Li <longli@...rosoft.com>, stable@...r.kernel.org
Subject: [PATCH v2] scsi: zero per-cmd private driver data for each MQ I/O

From: Long Li <longli@...rosoft.com>

In lower layer driver's (LLD) scsi_host_template, the driver may optionally 
ask SCSI to allocate its private driver memory for each command, by 
specifying cmd_size. This memory is allocated at the end of scsi_cmnd by SCSI. 
Later when SCSI queues a command, the LLD can use scsi_cmd_priv to get to its 
private data.

Some LLD, e.g. hv_storvsc, doesn't clear its private data before use. In
this case, the LLD may get to stale or uninitialized data in its private 
driver memory. This may result in unexpected driver and hardware behavior.

Fix this problem by also zeroing the private driver memory before passing
them to LLD.

Signed-off-by: Long Li <longli@...rosoft.com>
Reviewed-by: Bart Van Assche <Bart.VanAssche@...disk.com>
Reviewed-by: KY Srinivasan <kys@...rosoft.com>
Reviewed-by: Christoph Hellwig <hch@...radead.org>
CC: stable@...r.kernel.org

---
 drivers/scsi/scsi_lib.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 19125d7..a821593 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1850,7 +1850,7 @@ static int scsi_mq_prep_fn(struct request *req)

 	/* zero out the cmd, except for the embedded scsi_request */
 	memset((char *)cmd + sizeof(cmd->req), 0,
-		sizeof(*cmd) - sizeof(cmd->req));
+		sizeof(*cmd) - sizeof(cmd->req) + shost->hostt->cmd_size);

 	req->special = cmd;

-- 
2.7.4