scsi: aacraid: Don't copy uninitialized stack memory to userspace
authorSeth Forshee <seth.forshee@canonical.com>
Fri, 23 Jun 2017 14:04:22 +0000 (09:04 -0500)
committerMartin K. Petersen <martin.petersen@oracle.com>
Mon, 26 Jun 2017 19:01:03 +0000 (15:01 -0400)
Both aac_send_raw_srb() and aac_get_hba_info() may copy stack allocated
structs to userspace without initializing all members of these
structs. Clear out this memory to prevent information leaks.

Fixes: 423400e64d377 ("scsi: aacraid: Include HBA direct interface")
Fixes: c799d519bf088 ("scsi: aacraid: Retrieve HBA host information ioctl")
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
drivers/scsi/aacraid/commctrl.c

index 6bb6ed48e31dc6d77fa2f6a8c5b6f3a382e4a824..9ab0fa959d8355c62b8fd0514af8af278898481f 100644 (file)
@@ -949,6 +949,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
                        &((struct aac_native_hba *)srbfib->hw_fib_va)->resp.err;
                struct aac_srb_reply reply;
 
+               memset(&reply, 0, sizeof(reply));
                reply.status = ST_OK;
                if (srbfib->flags & FIB_CONTEXT_FLAG_FASTRESP) {
                        /* fast response */
@@ -1020,6 +1021,7 @@ static int aac_get_hba_info(struct aac_dev *dev, void __user *arg)
 {
        struct aac_hba_info hbainfo;
 
+       memset(&hbainfo, 0, sizeof(hbainfo));
        hbainfo.adapter_number          = (u8) dev->id;
        hbainfo.system_io_bus_number    = dev->pdev->bus->number;
        hbainfo.device_number           = (dev->pdev->devfn >> 3);