mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-29 13:53:33 +00:00
scsi: sr: Do not leak information in ioctl
[ Upstream commitfaad6cebde
] sr_ioctl.c uses this pattern: result = sr_do_ioctl(cd, &cgc); to-user = buffer[]; kfree(buffer); return result; Use of a buffer without checking leaks information. Check result and jump over the use of buffer if there is an error. result = sr_do_ioctl(cd, &cgc); if (result) goto err; to-user = buffer[]; err: kfree(buffer); return result; Additionally, initialize the buffer to zero. This problem can be seen in the 2.4.0 kernel. Link: https://lore.kernel.org/r/20220411174756.2418435-1-trix@redhat.com Fixes:1da177e4c3
("Linux-2.6.12-rc2") Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Tom Rix <trix@redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
69eeaa611c
commit
d4f8bb41a4
1 changed files with 12 additions and 3 deletions
|
@ -41,7 +41,7 @@ static int sr_read_tochdr(struct cdrom_device_info *cdi,
|
|||
int result;
|
||||
unsigned char *buffer;
|
||||
|
||||
buffer = kmalloc(32, GFP_KERNEL);
|
||||
buffer = kzalloc(32, GFP_KERNEL);
|
||||
if (!buffer)
|
||||
return -ENOMEM;
|
||||
|
||||
|
@ -55,10 +55,13 @@ static int sr_read_tochdr(struct cdrom_device_info *cdi,
|
|||
cgc.data_direction = DMA_FROM_DEVICE;
|
||||
|
||||
result = sr_do_ioctl(cd, &cgc);
|
||||
if (result)
|
||||
goto err;
|
||||
|
||||
tochdr->cdth_trk0 = buffer[2];
|
||||
tochdr->cdth_trk1 = buffer[3];
|
||||
|
||||
err:
|
||||
kfree(buffer);
|
||||
return result;
|
||||
}
|
||||
|
@ -71,7 +74,7 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi,
|
|||
int result;
|
||||
unsigned char *buffer;
|
||||
|
||||
buffer = kmalloc(32, GFP_KERNEL);
|
||||
buffer = kzalloc(32, GFP_KERNEL);
|
||||
if (!buffer)
|
||||
return -ENOMEM;
|
||||
|
||||
|
@ -86,6 +89,8 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi,
|
|||
cgc.data_direction = DMA_FROM_DEVICE;
|
||||
|
||||
result = sr_do_ioctl(cd, &cgc);
|
||||
if (result)
|
||||
goto err;
|
||||
|
||||
tocentry->cdte_ctrl = buffer[5] & 0xf;
|
||||
tocentry->cdte_adr = buffer[5] >> 4;
|
||||
|
@ -98,6 +103,7 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi,
|
|||
tocentry->cdte_addr.lba = (((((buffer[8] << 8) + buffer[9]) << 8)
|
||||
+ buffer[10]) << 8) + buffer[11];
|
||||
|
||||
err:
|
||||
kfree(buffer);
|
||||
return result;
|
||||
}
|
||||
|
@ -384,7 +390,7 @@ int sr_get_mcn(struct cdrom_device_info *cdi, struct cdrom_mcn *mcn)
|
|||
{
|
||||
Scsi_CD *cd = cdi->handle;
|
||||
struct packet_command cgc;
|
||||
char *buffer = kmalloc(32, GFP_KERNEL);
|
||||
char *buffer = kzalloc(32, GFP_KERNEL);
|
||||
int result;
|
||||
|
||||
if (!buffer)
|
||||
|
@ -400,10 +406,13 @@ int sr_get_mcn(struct cdrom_device_info *cdi, struct cdrom_mcn *mcn)
|
|||
cgc.data_direction = DMA_FROM_DEVICE;
|
||||
cgc.timeout = IOCTL_TIMEOUT;
|
||||
result = sr_do_ioctl(cd, &cgc);
|
||||
if (result)
|
||||
goto err;
|
||||
|
||||
memcpy(mcn->medium_catalog_number, buffer + 9, 13);
|
||||
mcn->medium_catalog_number[13] = 0;
|
||||
|
||||
err:
|
||||
kfree(buffer);
|
||||
return result;
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue