linux-kernel - Re: [PATCH] scsi: sr: Fix a potential uninit-value in sr_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 30 Oct 2023 10:02:24 -0500
From:   michael.christie@...cle.com
To:     Shigeru Yoshida <syoshida@...hat.com>, bvanassche@....org
Cc:     jejb@...ux.ibm.com, martin.petersen@...cle.com,
        linux-scsi@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] scsi: sr: Fix a potential uninit-value in sr_get_events()

On 10/30/23 3:13 AM, Shigeru Yoshida wrote:
> On Wed, 31 May 2023 15:44:17 -0700, Bart Van Assche wrote:
>> On 5/31/23 09:43, Shigeru Yoshida wrote:
>>> diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
>>> index 12869e6d4ebd..86b43c069a44 100644
>>> --- a/drivers/scsi/sr.c
>>> +++ b/drivers/scsi/sr.c
>>> @@ -177,10 +177,13 @@ static unsigned int sr_get_events(struct
>>> scsi_device *sdev)
>>>     	result = scsi_execute_cmd(sdev, cmd, REQ_OP_DRV_IN, buf, sizeof(buf),
>>>   				  SR_TIMEOUT, MAX_RETRIES, &exec_args);
>>> +	if (result)
>>> +		return 0;
>>> +
>>>   	if (scsi_sense_valid(&sshdr) && sshdr.sense_key == UNIT_ATTENTION)
>>>   		return DISK_EVENT_MEDIA_CHANGE;
>>>   -	if (result || be16_to_cpu(eh->data_len) < sizeof(*med))
>>> +	if (be16_to_cpu(eh->data_len) < sizeof(*med))
>>>   		return 0;
>>
>> I think this change is wrong because it introduces an unintended
>> behavior
>> change. A better solution is probably to zero-initialize sshdr before
>> scsi_execute_cmd() is called.
> 
> Hi Bart,
> 
> I'm very sorry for the very late response, and thank you so much for
> your feedback. I'll prepare the v2 patch as you suggested.

We actually just did this patch for the next kernel where we just
check result before accessing the sshdr:

https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git/commit/?h=6.7/scsi-staging&id=f7d7129c6c24168b9be7709b0b37767b5f743cf3