linux-kernel - Re: [PATCH] scsi: sr: Fix a potential uninit-value in sr_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <c459dd2c-a281-7fc4-90cf-36a71e9548bc@acm.org>
Date:   Wed, 31 May 2023 15:44:17 -0700
From:   Bart Van Assche <bvanassche@....org>
To:     Shigeru Yoshida <syoshida@...hat.com>, jejb@...ux.ibm.com,
        martin.petersen@...cle.com
Cc:     linux-scsi@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] scsi: sr: Fix a potential uninit-value in sr_get_events()

On 5/31/23 09:43, Shigeru Yoshida wrote:
> diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
> index 12869e6d4ebd..86b43c069a44 100644
> --- a/drivers/scsi/sr.c
> +++ b/drivers/scsi/sr.c
> @@ -177,10 +177,13 @@ static unsigned int sr_get_events(struct scsi_device *sdev)
>   
>   	result = scsi_execute_cmd(sdev, cmd, REQ_OP_DRV_IN, buf, sizeof(buf),
>   				  SR_TIMEOUT, MAX_RETRIES, &exec_args);
> +	if (result)
> +		return 0;
> +
>   	if (scsi_sense_valid(&sshdr) && sshdr.sense_key == UNIT_ATTENTION)
>   		return DISK_EVENT_MEDIA_CHANGE;
>   
> -	if (result || be16_to_cpu(eh->data_len) < sizeof(*med))
> +	if (be16_to_cpu(eh->data_len) < sizeof(*med))
>   		return 0;

I think this change is wrong because it introduces an unintended behavior
change. A better solution is probably to zero-initialize sshdr before
scsi_execute_cmd() is called.

Thanks,

Bart.