linux-kernel - [PATCH 6.6 116/129] hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250115103558.972203687@linuxfoundation.org>
Date: Wed, 15 Jan 2025 11:38:11 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: stable@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	patches@...ts.linux.dev,
	Daniil Stas <daniil.stas@...teo.net>,
	Guenter Roeck <linux@...ck-us.net>,
	Chris Healy <cphealy@...il.com>,
	Linus Walleij <linus.walleij@...aro.org>,
	"Martin K. Petersen" <martin.petersen@...cle.com>,
	Bart Van Assche <bvanassche@....org>,
	linux-kernel@...r.kernel.org,
	linux-scsi@...r.kernel.org,
	linux-ide@...r.kernel.org,
	linux-hwmon@...r.kernel.org,
	Sasha Levin <sashal@...nel.org>
Subject: [PATCH 6.6 116/129] hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Daniil Stas <daniil.stas@...teo.net>

[ Upstream commit 82163d63ae7a4c36142cd252388737205bb7e4b9 ]

scsi_execute_cmd() function can return both negative (linux codes) and
positive (scsi_cmnd result field) error codes.

Currently the driver just passes error codes of scsi_execute_cmd() to
hwmon core, which is incorrect because hwmon only checks for negative
error codes. This leads to hwmon reporting uninitialized data to
userspace in case of SCSI errors (for example if the disk drive was
disconnected).

This patch checks scsi_execute_cmd() output and returns -EIO if it's
error code is positive.

Fixes: 5b46903d8bf37 ("hwmon: Driver for disk and solid state drives with temperature sensors")
Signed-off-by: Daniil Stas <daniil.stas@...teo.net>
Cc: Guenter Roeck <linux@...ck-us.net>
Cc: Chris Healy <cphealy@...il.com>
Cc: Linus Walleij <linus.walleij@...aro.org>
Cc: Martin K. Petersen <martin.petersen@...cle.com>
Cc: Bart Van Assche <bvanassche@....org>
Cc: linux-kernel@...r.kernel.org
Cc: linux-scsi@...r.kernel.org
Cc: linux-ide@...r.kernel.org
Cc: linux-hwmon@...r.kernel.org
Link: https://lore.kernel.org/r/20250105213618.531691-1-daniil.stas@posteo.net
[groeck: Avoid inline variable declaration for portability]
Signed-off-by: Guenter Roeck <linux@...ck-us.net>
Signed-off-by: Sasha Levin <sashal@...nel.org>
---
 drivers/hwmon/drivetemp.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/hwmon/drivetemp.c b/drivers/hwmon/drivetemp.c
index 6bdd21aa005a..2a4ec55ddb47 100644
--- a/drivers/hwmon/drivetemp.c
+++ b/drivers/hwmon/drivetemp.c
@@ -165,6 +165,7 @@ static int drivetemp_scsi_command(struct drivetemp_data *st,
 {
 	u8 scsi_cmd[MAX_COMMAND_SIZE];
 	enum req_op op;
+	int err;
 
 	memset(scsi_cmd, 0, sizeof(scsi_cmd));
 	scsi_cmd[0] = ATA_16;
@@ -192,8 +193,11 @@ static int drivetemp_scsi_command(struct drivetemp_data *st,
 	scsi_cmd[12] = lba_high;
 	scsi_cmd[14] = ata_command;
 
-	return scsi_execute_cmd(st->sdev, scsi_cmd, op, st->smartdata,
-				ATA_SECT_SIZE, HZ, 5, NULL);
+	err = scsi_execute_cmd(st->sdev, scsi_cmd, op, st->smartdata,
+			       ATA_SECT_SIZE, HZ, 5, NULL);
+	if (err > 0)
+		err = -EIO;
+	return err;
 }
 
 static int drivetemp_ata_command(struct drivetemp_data *st, u8 feature,
-- 
2.39.5